The feature is selecting config based on the name, but not the exact name but
rather a regular expression.
Scenario:
OSSEC server with X VM's connected to it.
*agent.conf:*
<agent_config name="*REGEX1*">
<localfile>
<location>/var/log/my1.log</location>
<log_format>syslog</log_format>
</localfile></agent_config>
<agent_config name="*REGEX2*">
<localfile>
<location>/var/log/my2.log</location>
<log_format>syslog</log_format>
</localfile></agent_config>
On REGEX1 I would select every VM name that starts with the letter 'A'
On REGEX2 I would select every VM name that starts with the letter 'B'
So, based on its name I would have different configs on these VM's.
This simplifies how I would manage the ~100 VM's.
Since they're all on the same hardware, I want them to rootcheck and
systemcheck on different days of the week and only once a week.
quarta-feira, 11 de Fevereiro de 2015 às 18:00:40 UTC, dan (ddpbsd)
escreveu:
>
> On Wed, Feb 11, 2015 at 12:56 PM, Ricardo Perre <[email protected]
> <javascript:>> wrote:
> > Hello,
> >
> > I've tested the config, it doesn't work.
> >
> > I haven't tested the profile settings, I was aiming to manage clients in
> a
> > different way.
> > I have a hypervisor with ~100 VM's on it, if I could differentiate the
> OSSEC
> > config based on the name I wouldn't have to worry about setting a
> profile.
> >
> > Is this feature planned by any chance?
> >
>
> It might be a post-lunchtime haze, but I don't understand the feature
> you're describing.
>
> >
> > terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre
> > escreveu:
> >>
> >> Hello,
> >>
> >> Is it possible to define a profile based on "name" filtered by regex?
> >> In documentation we have:
> >>
> >>
> >> <agent_config name="agent1">
> >> <localfile>
> >> <location>/var/log/my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >> <agent_config os="Linux">
> >> <localfile>
> >> <location>/var/log/my.log2</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >> <agent_config os="Windows">
> >> <localfile>
> >> <location>C:\myapp\my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >>
> >>
> >> Can i use something like this?
> >>
> >>
> >> <agent_config name="REGEX">
> >> <localfile>
> >> <location>/var/log/my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >>
> >> <agent_config os="Linux">
> >> <localfile>
> >> <location>/var/log/my.log2</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >> <agent_config os="Windows">
> >> <localfile>
> >> <location>C:\myapp\my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >>
> >> Thanks for your time.
> >>
> >
> > terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre
> > escreveu:
> >>
> >> Hello,
> >>
> >> Is it possible to define a profile based on "name" filtered by regex?
> >> In documentation we have:
> >>
> >>
> >> <agent_config name="agent1">
> >> <localfile>
> >> <location>/var/log/my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >> <agent_config os="Linux">
> >> <localfile>
> >> <location>/var/log/my.log2</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >> <agent_config os="Windows">
> >> <localfile>
> >> <location>C:\myapp\my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >>
> >>
> >> Can i use something like this?
> >>
> >>
> >> <agent_config name="REGEX">
> >> <localfile>
> >> <location>/var/log/my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >>
> >> <agent_config os="Linux">
> >> <localfile>
> >> <location>/var/log/my.log2</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >> <agent_config os="Windows">
> >> <localfile>
> >> <location>C:\myapp\my.log</location>
> >> <log_format>syslog</log_format>
> >> </localfile>
> >> </agent_config>
> >>
> >>
> >> Thanks for your time.
> >>
> > --
> >
> > ---
> > You received this message because you are subscribed to the Google
> Groups
> > "ossec-list" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an
> > email to [email protected] <javascript:>.
> > For more options, visit https://groups.google.com/d/optout.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
