Hi, can you please explain to me what exactly does this diff do to config.c? Do I have to apply it on the server as well? Or just on a client to see if it matches the actual hostname? Also, can you please tell me where should I find the "This seems to have matched: %s" log entry?
Thanks, Radu -- *Radu Popescu* *mobile:* +40768.748.394 *e-mail:* [email protected] *web:* http://linuxsysadm.wordpress.com On Thu, Jan 17, 2013 at 7:27 PM, dan (ddp) <[email protected]> wrote: > On Thu, Jan 17, 2013 at 12:00 PM, dan (ddp) <[email protected]> wrote: > > On Thu, Jan 10, 2013 at 9:09 AM, pvradu <[email protected]> wrote: > >> Hi, > >> > >> I have a shared agent.conf that gets on every agent installed in which I > >> have multiple agent_config sections. > >> For example I have the following config: > >> > >> <agent_config name="1.1.1.123"> > >> ... > >> </agent_config> > >> <agent_config name="1.1.1.12|2.2.2.2"> > >> ... > >> </agent_config> > >> (my agent names are the same with IP addresses) > >> > >> The thing is that on machine 1.1.1.123 both configs get loaded (for > 1.1.1.12 > >> and 1.1.1.123, and I have some duplication errors. > >> So, my question is, how can I mark the end of the string in the config > with > >> 1.1.1.12? So 1.1.1.123 will not match that config. > >> Also tried "^1.1.1.12$|2.2.2.2" but with no luck. (like this, the > config on > >> 1.1.1.123 loads ok, but 1.1.1.12 doesn't get recognized) > >> OSSEC version is 2.7. (actually, in the process of upgrading from 2.6) > >> > >> Thanks, > >> Radu > > > > I can definitely reproduce this (even tried it with reasonable agent > > names). I thought it would get pulled in from ReadConfig > > (src/config/config.c), specifically in the section with the comment: > > "/* Checking if there is an "name=" attribute */". Unfortunately I > > haven't been able to figure out a fix there. > > If anyone has a hint, that'd be great. > > This is probably horrible and would still need a LOT of testing, but > it seems to work for me... > --
