On Thu, Jan 10, 2013 at 9:09 AM, pvradu <[email protected]> wrote: > Hi, > > I have a shared agent.conf that gets on every agent installed in which I > have multiple agent_config sections. > For example I have the following config: > > <agent_config name="1.1.1.123"> > ... > </agent_config> > <agent_config name="1.1.1.12|2.2.2.2"> > ... > </agent_config> > (my agent names are the same with IP addresses) > > The thing is that on machine 1.1.1.123 both configs get loaded (for 1.1.1.12 > and 1.1.1.123, and I have some duplication errors. > So, my question is, how can I mark the end of the string in the config with > 1.1.1.12? So 1.1.1.123 will not match that config. > Also tried "^1.1.1.12$|2.2.2.2" but with no luck. (like this, the config on > 1.1.1.123 loads ok, but 1.1.1.12 doesn't get recognized) > OSSEC version is 2.7. (actually, in the process of upgrading from 2.6) > > Thanks, > Radu
I can definitely reproduce this (even tried it with reasonable agent names). I thought it would get pulled in from ReadConfig (src/config/config.c), specifically in the section with the comment: "/* Checking if there is an "name=" attribute */". Unfortunately I haven't been able to figure out a fix there. If anyone has a hint, that'd be great.
