If I am correct, the additional directories have to be added in
<directories>
<syscheck>
<!-- Frequency that syscheck is executed - default to every 22 hours -->
<frequency>79200</frequency>
<!-- Directories to check (perform all possible verifications) -->
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories check_all="yes">/bin,/sbin</directories>
Will it be okay if we add all the directories we want to monitor in the
entire environment on the server ossec.conf only? Or will we have to add
those direcotries on each agent's ossec.conf file?
On Wednesday, 19 June 2013 15:18:29 UTC+5:30, Taher wrote:
>
> Hello All,
>
> I am newbie to OSSEC and we have installed a server and about 30 clients
> in our test environment.
>
> We have a requirement of monitoring logs and integrity checking for files
> and directories belonging to certain proprietary/custom applications in the
> environment. My question is, if we were to specify the location of these
> logs and files, would we have to do it in the ossec.conf file on each agent
> or can we do it centrally on the server?
>
>
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
