On Sep 23, 2014 6:04 AM, "dan (ddp)" <[email protected]> wrote: > > > On Sep 23, 2014 6:02 AM, "Phil Daws" <[email protected]> wrote: > > > > Hi Dan: > > > > it looks like from http://ossec-docs.readthedocs.org/en/latest/syntax/head_agent_config.html that only a single profile can be assigned. Would it be best to ask on the developers list ? > > > > Ask what? >
This makes me think multiple profiles should work http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.client.html#element-config-profile > > Thanks, Phil > > > > ----- Original Message ----- > > From: "dan (ddp)" <[email protected]> > > To: [email protected] > > Sent: Tuesday, 23 September, 2014 10:49:47 AM > > Subject: Re: [ossec-list] agent.conf and multiple profiles > > > > > > > > On Sep 23, 2014 5:28 AM, "Phil Daws" < [email protected] > wrote: > > > > > > Hello all, > > > > > > am I correct in assuming that ossec.conf is only able to handle a single agent profile ? so we would not be able to do <config-profile>hosting,www</config-profile> and in shared/agent.conf: > > > > > > <agent_config profile="hosting"> > > > <rootcheck> > > > <check_pids>no</check_pids> > > > </rootcheck> > > > </agent_config> > > > <agent_config profile="www"> > > > <localfile> > > > <location>/systems/[a-zA-Z0-9]*/var/log/cron</location> > > > <log_format>syslog</log_format> > > > </localfile> > > > </agent_config> > > > > > > if not I believe it would be a good RFE so that one could stack the profiles without having to duplicate each stanza. > > > > > > Thoughts ? Thanks, Phil > > > > > I haven't looked at the docs or tried it lately, but I think you can use multiple profiles. Issues and patches are appreciated > > > > > -- > > > > > > --- > > > You received this message because you are subscribed to the Google Groups "ossec-list" group. > > > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] . > > > For more options, visit https://groups.google.com/d/optout . > > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] . > > For more options, visit https://groups.google.com/d/optout . > > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
