Did you just use comma separation or multiple stanzas ? When I used commas it was only reading the first profile and not the following ones. Thanks, Phil
----- Original Message ----- From: "dan (ddp)" <[email protected]> To: [email protected] Sent: Tuesday, 23 September, 2014 1:18:35 PM Subject: Re: [ossec-list] agent.conf and multiple profiles On Tue, Sep 23, 2014 at 6:43 AM, dan (ddp) <[email protected]> wrote: > > On Sep 23, 2014 6:04 AM, "dan (ddp)" <[email protected]> wrote: >> >> >> On Sep 23, 2014 6:02 AM, "Phil Daws" <[email protected]> wrote: >> > >> > Hi Dan: >> > >> > it looks like from >> > http://ossec-docs.readthedocs.org/en/latest/syntax/head_agent_config.html >> > that only a single profile can be assigned. Would it be best to ask on the >> > developers list ? >> > >> >> Ask what? >> > > This makes me think multiple profiles should work > http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.client.html#element-config-profile > I just setup a test environment, and it works great with multiple profiles for me. What problems were you having with it? Any error messages? >> > Thanks, Phil >> > >> > ----- Original Message ----- >> > From: "dan (ddp)" <[email protected]> >> > To: [email protected] >> > Sent: Tuesday, 23 September, 2014 10:49:47 AM >> > Subject: Re: [ossec-list] agent.conf and multiple profiles >> > >> > >> > >> > On Sep 23, 2014 5:28 AM, "Phil Daws" < [email protected] > wrote: >> > > >> > > Hello all, >> > > >> > > am I correct in assuming that ossec.conf is only able to handle a >> > > single agent profile ? so we would not be able to do >> > > <config-profile>hosting,www</config-profile> and in shared/agent.conf: >> > > >> > > <agent_config profile="hosting"> >> > > <rootcheck> >> > > <check_pids>no</check_pids> >> > > </rootcheck> >> > > </agent_config> >> > > <agent_config profile="www"> >> > > <localfile> >> > > <location>/systems/[a-zA-Z0-9]*/var/log/cron</location> >> > > <log_format>syslog</log_format> >> > > </localfile> >> > > </agent_config> >> > > >> > > if not I believe it would be a good RFE so that one could stack the >> > > profiles without having to duplicate each stanza. >> > > >> > > Thoughts ? Thanks, Phil >> > > >> > I haven't looked at the docs or tried it lately, but I think you can use >> > multiple profiles. Issues and patches are appreciated >> > >> > > -- >> > > >> > > --- >> > > You received this message because you are subscribed to the Google >> > > Groups "ossec-list" group. >> > > To unsubscribe from this group and stop receiving emails from it, send >> > > an email to [email protected] . >> > > For more options, visit https://groups.google.com/d/optout . >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an email to [email protected] . >> > For more options, visit https://groups.google.com/d/optout . >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
