On Wed, Feb 11, 2015 at 1:11 PM, Ricardo Perre <[email protected]> wrote:
>
> The feature is selecting config based on the name, but not the exact name
> but rather a regular expression.
> Scenario:
> OSSEC server with X VM's connected to it.
>
> agent.conf:
>
> <agent_config name="REGEX1">
>     <localfile>
>         <location>/var/log/my1.log</location>
>         <log_format>syslog</log_format>
>     </localfile>
> </agent_config>
>
>
> <agent_config name="REGEX2">
>     <localfile>
>         <location>/var/log/my2.log</location>
>         <log_format>syslog</log_format>
>     </localfile>
> </agent_config>
>
>
>
> On REGEX1 I would select every VM name that starts with the letter 'A'
> On REGEX2 I would select every VM name that starts with the letter 'B'
>
> So, based on its name I would have different configs on these VM's.
> This simplifies how I would manage the ~100 VM's.
> Since they're all on the same hardware, I want them to rootcheck and
> systemcheck on different days of the week and only once a week.
>

Gotcha. That's not planned as far as I know. If you find the time to
code it up, please submit a pull request though:
https://github.com/ossec/ossec-hids

The closest you could get now would be using agent profiles. But all
of this seems more of a hassle than just using puppet or chef.

>
>
>
> quarta-feira, 11 de Fevereiro de 2015 às 18:00:40 UTC, dan (ddpbsd)
> escreveu:
>>
>> On Wed, Feb 11, 2015 at 12:56 PM, Ricardo Perre <[email protected]> wrote:
>> > Hello,
>> >
>> > I've tested the config, it doesn't work.
>> >
>> > I haven't tested the profile settings, I was aiming to manage clients in
>> > a
>> > different way.
>> > I have a hypervisor with ~100 VM's on it, if I could differentiate the
>> > OSSEC
>> > config based on the name I wouldn't have to worry about setting a
>> > profile.
>> >
>> > Is this feature planned by any chance?
>> >
>>
>> It might be a post-lunchtime haze, but I don't understand the feature
>> you're describing.
>>
>> >
>> > terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre
>> > escreveu:
>> >>
>> >> Hello,
>> >>
>> >> Is it possible to define a profile based on "name" filtered by regex?
>> >> In documentation we have:
>> >>
>> >>
>> >> <agent_config name="agent1">
>> >>     <localfile>
>> >>         <location>/var/log/my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >> <agent_config os="Linux">
>> >>     <localfile>
>> >>         <location>/var/log/my.log2</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >> <agent_config os="Windows">
>> >>     <localfile>
>> >>         <location>C:\myapp\my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >>
>> >>
>> >> Can i use something like this?
>> >>
>> >>
>> >> <agent_config name="REGEX">
>> >>     <localfile>
>> >>         <location>/var/log/my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >>
>> >> <agent_config os="Linux">
>> >>     <localfile>
>> >>         <location>/var/log/my.log2</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >> <agent_config os="Windows">
>> >>     <localfile>
>> >>         <location>C:\myapp\my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >>
>> >> Thanks for your time.
>> >>
>> >
>> > terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre
>> > escreveu:
>> >>
>> >> Hello,
>> >>
>> >> Is it possible to define a profile based on "name" filtered by regex?
>> >> In documentation we have:
>> >>
>> >>
>> >> <agent_config name="agent1">
>> >>     <localfile>
>> >>         <location>/var/log/my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >> <agent_config os="Linux">
>> >>     <localfile>
>> >>         <location>/var/log/my.log2</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >> <agent_config os="Windows">
>> >>     <localfile>
>> >>         <location>C:\myapp\my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >>
>> >>
>> >> Can i use something like this?
>> >>
>> >>
>> >> <agent_config name="REGEX">
>> >>     <localfile>
>> >>         <location>/var/log/my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >>
>> >> <agent_config os="Linux">
>> >>     <localfile>
>> >>         <location>/var/log/my.log2</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >> <agent_config os="Windows">
>> >>     <localfile>
>> >>         <location>C:\myapp\my.log</location>
>> >>         <log_format>syslog</log_format>
>> >>     </localfile>
>> >> </agent_config>
>> >>
>> >>
>> >> Thanks for your time.
>> >>
>> > --
>> >
>> > ---
>> > You received this message because you are subscribed to the Google
>> > Groups
>> > "ossec-list" group.
>> > To unsubscribe from this group and stop receiving emails from it, send
>> > an
>> > email to [email protected].
>> > For more options, visit https://groups.google.com/d/optout.
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to