On Wed, Feb 5, 2014 at 4:22 PM, Sean Jackson <[email protected]> wrote: > http://ossec-docs.readthedocs.org/en/latest/manual/agent/agent-configuration.html > I got really excited when I read this page. I made some changes to files > being watched and was glad I didn't have to hop around to all the agents and > add to the conf files one by one. I edited /var/ossec/etc/shared/agent.conf > with my changes, restarted /bin/ossec-control to propagate the changes > faster, and let it go for a day. Two days later, checking the md5sum of my > local /etc/shared/agent.conf doesn't match any agent client version. > > Should I be checking that still? Or is there a different way to check for > consistency without logging into an agent box? >
`/var/ossec/bin/agent_control -i AGENT_NUMBER` should give you the md5 of the agent.conf on the agent. > And where do I start debugging this? > Start with permissions of the files in /var/ossec/etc/shared, on both the agent and server. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
