dan, thanks for the quick response. i was trying to stay away from changing scripts, but if that's the only way it's done then so be it. :) thanks again. tom
> Date: Wed, 19 Feb 2014 09:18:25 -0500 > Subject: Re: [ossec-list] can i set OSSEC to report only? > From: [email protected] > To: [email protected] > > On Wed, Feb 19, 2014 at 9:12 AM, Thomas Moretto <[email protected]> wrote: > > i'd like to put an ossec agent on one of my web servers but i don't want it > > to take action on anything just yet ... i'd like to have it report what it > > would have done so i know what to expect when i install it. > > > > is that possible? > > > > You can set it up to take no actions by disabling active response. > You can see what ARs would fire by replacing the scripts in > /var/ossec/active-response/bin with fakes that write to a log. > Other than that, we don't really have a dry run mode. > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [email protected]. > > For more options, visit https://groups.google.com/groups/opt_out. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
