On Wed, Jun 19, 2013 at 7:24 AM, Taher <[email protected]> wrote: > If I am correct, the additional directories have to be added in > <directories> > > <syscheck> > <!-- Frequency that syscheck is executed - default to every 22 hours --> > <frequency>79200</frequency> > > <!-- Directories to check (perform all possible verifications) --> > <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> > <directories check_all="yes">/bin,/sbin</directories> > > Will it be okay if we add all the directories we want to monitor in the > entire environment on the server ossec.conf only? Or will we have to add > those direcotries on each agent's ossec.conf file? >
Those settings are local. If you change them on the server, you will only be changing them on the server. If you want to centrally manage the agents, use the /var/ossec/etc/shared/agent.conf > > On Wednesday, 19 June 2013 15:18:29 UTC+5:30, Taher wrote: >> >> Hello All, >> >> I am newbie to OSSEC and we have installed a server and about 30 clients >> in our test environment. >> >> We have a requirement of monitoring logs and integrity checking for files >> and directories belonging to certain proprietary/custom applications in the >> environment. My question is, if we were to specify the location of these >> logs and files, would we have to do it in the ossec.conf file on each agent >> or can we do it centrally on the server? >> >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
