Looks like the <space> was the magic ingredient! Thanks Dan. ----- Original Message ----- From: "dan (ddp)" <[email protected]> To: [email protected] Sent: Wednesday, 24 September, 2014 10:13:14 AM Subject: Re: [ossec-list] agent.conf and multiple profiles
On Sep 24, 2014 5:11 AM, "Phil Daws" < [email protected] > wrote: > > Did you just use comma separation or multiple stanzas ? When I used commas it > was only reading the first profile and not the following ones. Thanks, Phil > Comma and a space. > ----- Original Message ----- > From: "dan (ddp)" < [email protected] > > To: [email protected] > Sent: Tuesday, 23 September, 2014 1:18:35 PM > Subject: Re: [ossec-list] agent.conf and multiple profiles > > On Tue, Sep 23, 2014 at 6:43 AM, dan (ddp) < [email protected] > wrote: > > > > On Sep 23, 2014 6:04 AM, "dan (ddp)" < [email protected] > wrote: > >> > >> > >> On Sep 23, 2014 6:02 AM, "Phil Daws" < [email protected] > wrote: > >> > > >> > Hi Dan: > >> > > >> > it looks like from > >> > http://ossec-docs.readthedocs.org/en/latest/syntax/head_agent_config.html > >> > > >> > that only a single profile can be assigned. Would it be best to ask on > >> > the > >> > developers list ? > >> > > >> > >> Ask what? > >> > > > > This makes me think multiple profiles should work > > http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.client.html#element-config-profile > > > > > > I just setup a test environment, and it works great with multiple > profiles for me. What problems were you having with it? Any error > messages? > > >> > Thanks, Phil > >> > > >> > ----- Original Message ----- > >> > From: "dan (ddp)" < [email protected] > > >> > To: [email protected] > >> > Sent: Tuesday, 23 September, 2014 10:49:47 AM > >> > Subject: Re: [ossec-list] agent.conf and multiple profiles > >> > > >> > > >> > > >> > On Sep 23, 2014 5:28 AM, "Phil Daws" < [email protected] > wrote: > >> > > > >> > > Hello all, > >> > > > >> > > am I correct in assuming that ossec.conf is only able to handle a > >> > > single agent profile ? so we would not be able to do > >> > > <config-profile>hosting,www</config-profile> and in shared/agent.conf: > >> > > > >> > > <agent_config profile="hosting"> > >> > > <rootcheck> > >> > > <check_pids>no</check_pids> > >> > > </rootcheck> > >> > > </agent_config> > >> > > <agent_config profile="www"> > >> > > <localfile> > >> > > <location>/systems/[a-zA-Z0-9]*/var/log/cron</location> > >> > > <log_format>syslog</log_format> > >> > > </localfile> > >> > > </agent_config> > >> > > > >> > > if not I believe it would be a good RFE so that one could stack the > >> > > profiles without having to duplicate each stanza. > >> > > > >> > > Thoughts ? Thanks, Phil > >> > > > >> > I haven't looked at the docs or tried it lately, but I think you can use > >> > multiple profiles. Issues and patches are appreciated > >> > > >> > > -- > >> > > > >> > > --- > >> > > You received this message because you are subscribed to the Google > >> > > Groups "ossec-list" group. > >> > > To unsubscribe from this group and stop receiving emails from it, send > >> > > an email to [email protected] . > >> > > For more options, visit https://groups.google.com/d/optout . > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, send > >> > an email to [email protected] . > >> > For more options, visit https://groups.google.com/d/optout . > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, send > >> > an email to [email protected] . > >> > For more options, visit https://groups.google.com/d/optout . > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] . > For more options, visit https://groups.google.com/d/optout . > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] . > For more options, visit https://groups.google.com/d/optout . -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] . For more options, visit https://groups.google.com/d/optout . -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
