On Sep 23, 2014 5:28 AM, "Phil Daws" <[email protected]> wrote: > > Hello all, > > am I correct in assuming that ossec.conf is only able to handle a single agent profile ? so we would not be able to do <config-profile>hosting,www</config-profile> and in shared/agent.conf: > > <agent_config profile="hosting"> > <rootcheck> > <check_pids>no</check_pids> > </rootcheck> > </agent_config> > <agent_config profile="www"> > <localfile> > <location>/systems/[a-zA-Z0-9]*/var/log/cron</location> > <log_format>syslog</log_format> > </localfile> > </agent_config> > > if not I believe it would be a good RFE so that one could stack the profiles without having to duplicate each stanza. > > Thoughts ? Thanks, Phil >
I haven't looked at the docs or tried it lately, but I think you can use multiple profiles. Issues and patches are appreciated > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
