I found this did not matter for me. What I had to do was modify
/var/ossec/etc/ossec.conf and update like 3 and 4 to the following:
<client>
<server-ip>ENTERIPOFSERVERHERE</server-ip.
</client>
execute /var/ossec/bin/manage_agents to import key
make sure my server was ready to accept traffic from the agent
execute "/var/ossec/bin/ossec-control start" to start the services
execute "/var/ossec/bin/ossec-control status" to check the status
validate the server is getting the traffic. my server alienvault so i did
not include the server side commands since I used the webui within it.
On Monday, November 26, 2012 9:47:56 PM UTC-5, Jb Cheng wrote:
>
> From dcid's patch posted by dan on ossec-dev, change install.sh line 372:
>
> - if [[ "X${USER_AGENT_SERVER_IP}" = "X" &&
> "X${USER_AGENT_SERVER_NAME}" = "X" ]]; then
> + if [ "X${USER_AGENT_SERVER_IP}" = "X" -a "X${USER_AGENT_SERVER_NAME}"
> = "X" ]; then
>
>
> On Thursday, November 22, 2012 7:54:19 PM UTC-8, Michael Starks wrote:
>>
>> On 11/22/2012 12:49 PM, morgan cox wrote:
>> > just tried to install ossec 2.7
>> >
>> > Server install seems fine. however the 2.7 agent setup on Ubuntu 10.04
>> > doesn't install correctly.
>>
>> Untested, but try changing line 372 to this (watch for wrapping):
>>
>> if [ "X${USER_AGENT_SERVER_IP}" = "X" ] && [
>> "X${USER_AGENT_SERVER_NAME}" = "X" ]; then
>>
>>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
