On Sep 23, 2014 6:02 AM, "Phil Daws" <[email protected]> wrote: > > Hi Dan: > > it looks like from http://ossec-docs.readthedocs.org/en/latest/syntax/head_agent_config.html that only a single profile can be assigned. Would it be best to ask on the developers list ? >
Ask what? > Thanks, Phil > > ----- Original Message ----- > From: "dan (ddp)" <[email protected]> > To: [email protected] > Sent: Tuesday, 23 September, 2014 10:49:47 AM > Subject: Re: [ossec-list] agent.conf and multiple profiles > > > > On Sep 23, 2014 5:28 AM, "Phil Daws" < [email protected] > wrote: > > > > Hello all, > > > > am I correct in assuming that ossec.conf is only able to handle a single agent profile ? so we would not be able to do <config-profile>hosting,www</config-profile> and in shared/agent.conf: > > > > <agent_config profile="hosting"> > > <rootcheck> > > <check_pids>no</check_pids> > > </rootcheck> > > </agent_config> > > <agent_config profile="www"> > > <localfile> > > <location>/systems/[a-zA-Z0-9]*/var/log/cron</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > if not I believe it would be a good RFE so that one could stack the profiles without having to duplicate each stanza. > > > > Thoughts ? Thanks, Phil > > > I haven't looked at the docs or tried it lately, but I think you can use multiple profiles. Issues and patches are appreciated > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] . > > For more options, visit https://groups.google.com/d/optout . > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] . > For more options, visit https://groups.google.com/d/optout . > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
