On Wed, Sep 24, 2014 at 5:44 AM, Phil Daws <[email protected]> wrote: > Looks like the <space> was the magic ingredient! Thanks Dan. >
I'll have to update the docs for that. I'll probably create an issue as well. Thanks for the report back! > ----- Original Message ----- > From: "dan (ddp)" <[email protected]> > To: [email protected] > Sent: Wednesday, 24 September, 2014 10:13:14 AM > Subject: Re: [ossec-list] agent.conf and multiple profiles > > > > On Sep 24, 2014 5:11 AM, "Phil Daws" < [email protected] > wrote: >> >> Did you just use comma separation or multiple stanzas ? When I used commas >> it was only reading the first profile and not the following ones. Thanks, >> Phil >> > Comma and a space. >> ----- Original Message ----- >> From: "dan (ddp)" < [email protected] > >> To: [email protected] >> Sent: Tuesday, 23 September, 2014 1:18:35 PM >> Subject: Re: [ossec-list] agent.conf and multiple profiles >> >> On Tue, Sep 23, 2014 at 6:43 AM, dan (ddp) < [email protected] > wrote: >> > >> > On Sep 23, 2014 6:04 AM, "dan (ddp)" < [email protected] > wrote: >> >> >> >> >> >> On Sep 23, 2014 6:02 AM, "Phil Daws" < [email protected] > wrote: >> >> > >> >> > Hi Dan: >> >> > >> >> > it looks like from >> >> > http://ossec-docs.readthedocs.org/en/latest/syntax/head_agent_config.html >> >> > that only a single profile can be assigned. Would it be best to ask on >> >> > the >> >> > developers list ? >> >> > >> >> >> >> Ask what? >> >> >> > >> > This makes me think multiple profiles should work >> > http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.client.html#element-config-profile >> > >> >> I just setup a test environment, and it works great with multiple >> profiles for me. What problems were you having with it? Any error >> messages? >> >> >> > Thanks, Phil >> >> > >> >> > ----- Original Message ----- >> >> > From: "dan (ddp)" < [email protected] > >> >> > To: [email protected] >> >> > Sent: Tuesday, 23 September, 2014 10:49:47 AM >> >> > Subject: Re: [ossec-list] agent.conf and multiple profiles >> >> > >> >> > >> >> > >> >> > On Sep 23, 2014 5:28 AM, "Phil Daws" < [email protected] > wrote: >> >> > > >> >> > > Hello all, >> >> > > >> >> > > am I correct in assuming that ossec.conf is only able to handle a >> >> > > single agent profile ? so we would not be able to do >> >> > > <config-profile>hosting,www</config-profile> and in shared/agent.conf: >> >> > > >> >> > > <agent_config profile="hosting"> >> >> > > <rootcheck> >> >> > > <check_pids>no</check_pids> >> >> > > </rootcheck> >> >> > > </agent_config> >> >> > > <agent_config profile="www"> >> >> > > <localfile> >> >> > > <location>/systems/[a-zA-Z0-9]*/var/log/cron</location> >> >> > > <log_format>syslog</log_format> >> >> > > </localfile> >> >> > > </agent_config> >> >> > > >> >> > > if not I believe it would be a good RFE so that one could stack the >> >> > > profiles without having to duplicate each stanza. >> >> > > >> >> > > Thoughts ? Thanks, Phil >> >> > > >> >> > I haven't looked at the docs or tried it lately, but I think you can use >> >> > multiple profiles. Issues and patches are appreciated >> >> > >> >> > > -- >> >> > > >> >> > > --- >> >> > > You received this message because you are subscribed to the Google >> >> > > Groups "ossec-list" group. >> >> > > To unsubscribe from this group and stop receiving emails from it, send >> >> > > an email to [email protected] . >> >> > > For more options, visit https://groups.google.com/d/optout . >> >> > >> >> > -- >> >> > >> >> > --- >> >> > You received this message because you are subscribed to the Google >> >> > Groups "ossec-list" group. >> >> > To unsubscribe from this group and stop receiving emails from it, send >> >> > an email to [email protected] . >> >> > For more options, visit https://groups.google.com/d/optout . >> >> > >> >> > -- >> >> > >> >> > --- >> >> > You received this message because you are subscribed to the Google >> >> > Groups "ossec-list" group. >> >> > To unsubscribe from this group and stop receiving emails from it, send >> >> > an email to [email protected] . >> >> > For more options, visit https://groups.google.com/d/optout . >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] . >> For more options, visit https://groups.google.com/d/optout . >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] . >> For more options, visit https://groups.google.com/d/optout . > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] . > For more options, visit https://groups.google.com/d/optout . > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
