On Fri, Jan 25, 2013 at 5:22 AM, Radu Popescu <[email protected]> wrote: > Hi, > > can you please explain to me what exactly does this diff do to config.c?
It hopefully fixes the problem. I start by stripping the newline from the agentname variable, then compare the lengths of agentname2 and the agent name in the agent.conf entry. If they don't match in length, they aren't the same. > Do I have to apply it on the server as well? Or just on a client to see if > it matches the actual hostname? Ideally it would be installed everywhere, but I don't think it should do much on hosts that are not exhibiting the problem. If the patch is going to be considered it would have to be tested on a variety of systems. > Also, can you please tell me where should I find the "This seems to have > matched: %s" log entry? > ossec.log? > Thanks, > Radu > > > -- > Radu Popescu > mobile: +40768.748.394 > e-mail: [email protected] > web: http://linuxsysadm.wordpress.com > > > > > On Thu, Jan 17, 2013 at 7:27 PM, dan (ddp) <[email protected]> wrote: >> >> On Thu, Jan 17, 2013 at 12:00 PM, dan (ddp) <[email protected]> wrote: >> > On Thu, Jan 10, 2013 at 9:09 AM, pvradu <[email protected]> wrote: >> >> Hi, >> >> >> >> I have a shared agent.conf that gets on every agent installed in which >> >> I >> >> have multiple agent_config sections. >> >> For example I have the following config: >> >> >> >> <agent_config name="1.1.1.123"> >> >> ... >> >> </agent_config> >> >> <agent_config name="1.1.1.12|2.2.2.2"> >> >> ... >> >> </agent_config> >> >> (my agent names are the same with IP addresses) >> >> >> >> The thing is that on machine 1.1.1.123 both configs get loaded (for >> >> 1.1.1.12 >> >> and 1.1.1.123, and I have some duplication errors. >> >> So, my question is, how can I mark the end of the string in the config >> >> with >> >> 1.1.1.12? So 1.1.1.123 will not match that config. >> >> Also tried "^1.1.1.12$|2.2.2.2" but with no luck. (like this, the >> >> config on >> >> 1.1.1.123 loads ok, but 1.1.1.12 doesn't get recognized) >> >> OSSEC version is 2.7. (actually, in the process of upgrading from 2.6) >> >> >> >> Thanks, >> >> Radu >> > >> > I can definitely reproduce this (even tried it with reasonable agent >> > names). I thought it would get pulled in from ReadConfig >> > (src/config/config.c), specifically in the section with the comment: >> > "/* Checking if there is an "name=" attribute */". Unfortunately I >> > haven't been able to figure out a fix there. >> > If anyone has a hint, that'd be great. >> >> This is probably horrible and would still need a LOT of testing, but >> it seems to work for me... > > > -- > > > --
