Hello, I've tested the config, it doesn't work.
I haven't tested the profile settings, I was aiming to manage clients in a different way. I have a hypervisor with ~100 VM's on it, if I could differentiate the OSSEC config based on the name I wouldn't have to worry about setting a profile. Is this feature planned by any chance? terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre escreveu: > > Hello, > > Is it possible to define a profile based on "name" filtered by regex? > In documentation we have: > > > <agent_config name="agent1"> > <localfile> > <location>/var/log/my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > <agent_config os="Linux"> > <localfile> > <location>/var/log/my.log2</location> > <log_format>syslog</log_format> > </localfile></agent_config> > <agent_config os="Windows"> > <localfile> > <location>C:\myapp\my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > > Can i use something like this? > > > <agent_config name="*REGEX*"> > <localfile> > <location>/var/log/my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > <agent_config os="Linux"> > <localfile> > <location>/var/log/my.log2</location> > <log_format>syslog</log_format> > </localfile></agent_config> > <agent_config os="Windows"> > <localfile> > <location>C:\myapp\my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > Thanks for your time. > > terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre escreveu: > > Hello, > > Is it possible to define a profile based on "name" filtered by regex? > In documentation we have: > > > <agent_config name="agent1"> > <localfile> > <location>/var/log/my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > <agent_config os="Linux"> > <localfile> > <location>/var/log/my.log2</location> > <log_format>syslog</log_format> > </localfile></agent_config> > <agent_config os="Windows"> > <localfile> > <location>C:\myapp\my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > > Can i use something like this? > > > <agent_config name="*REGEX*"> > <localfile> > <location>/var/log/my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > <agent_config os="Linux"> > <localfile> > <location>/var/log/my.log2</location> > <log_format>syslog</log_format> > </localfile></agent_config> > <agent_config os="Windows"> > <localfile> > <location>C:\myapp\my.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > Thanks for your time. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
