On Wed, Feb 19, 2014 at 9:12 AM, Thomas Moretto <[email protected]> wrote: > i'd like to put an ossec agent on one of my web servers but i don't want it > to take action on anything just yet ... i'd like to have it report what it > would have done so i know what to expect when i install it. > > is that possible? >
You can set it up to take no actions by disabling active response. You can see what ARs would fire by replacing the scripts in /var/ossec/active-response/bin with fakes that write to a log. Other than that, we don't really have a dry run mode. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
