"not sure if I understood this correctly. Are you trying to read those files remotely?"
I have an OSSEC agent on my Windows server. I can easily add a localfile reference to watch over my IIS Websites but as I have 100 or so websites per server automation is pretty important. The question was could an agent based ossec.conf file pull in configuration references from a separate file? In this manner I could write out localfile references to this external file automatically without having to try to automatically edit a section in my ossec.conf file. Additionally as I read about using the agent.conf option to push config files out to the remote agents it would seem allowing the use of an external file for local customizations would make a lot of sense. James Whittington From: [email protected] [mailto:[email protected]] On Behalf Of Santiago Bassett Sent: Tuesday, August 27, 2013 12:22 AM To: [email protected] Subject: [ossec-list] Re: Option to include a file of local directory definitions on a Windows client Hi James, not sure if I understood this correctly. Are you trying to read those files remotely? How are those accessible? (samba?) If that is the case I guess those could probably be read as local. Best On Monday, August 26, 2013 7:46:15 PM UTC-7, James Whittington wrote: I am running a mixed environment of Linux and Windows Webservers and trying to determine how to add all my website logfiles. On the Linux Servers all the website logfiles reside in the same folder so I have a wildcard pattern to add all the website logfiles. On the Windows side however logfiles are stored by customer and website and thus do not exist in the same folder area. I was wondering if there was an option to reference an external file or directory for local file definitions? Then I could easily rebuild definitions in this external file as sites are added without having to modify the main config file. I am hoping I just missed this option as it sounds like something that could be in the agent.conf file and pushed out to multiple servers. James Whittington -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
