Hello Ricardo, you can use
<agent_config name="hostA01|hostA02|hostA03"> [...] </agent_config> <agent_config name="hostB01|hostB02|hostB03"> [...] </agent_config> Christian On Wed, Feb 11, 2015 at 10:11:34AM -0800, Ricardo Perre wrote: > > > The feature is selecting config based on the name, but not the exact name but > rather a regular expression. > Scenario: > OSSEC server with X VM's connected to it. > > *agent.conf:* > > <agent_config name="*REGEX1*"> > <localfile> > <location>/var/log/my1.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > <agent_config name="*REGEX2*"> > <localfile> > <location>/var/log/my2.log</location> > <log_format>syslog</log_format> > </localfile></agent_config> > > > > On REGEX1 I would select every VM name that starts with the letter 'A' > On REGEX2 I would select every VM name that starts with the letter 'B' > > So, based on its name I would have different configs on these VM's. > This simplifies how I would manage the ~100 VM's. > Since they're all on the same hardware, I want them to rootcheck and > systemcheck on different days of the week and only once a week. > > > > > quarta-feira, 11 de Fevereiro de 2015 às 18:00:40 UTC, dan (ddpbsd) > escreveu: > > > > On Wed, Feb 11, 2015 at 12:56 PM, Ricardo Perre <[email protected] > > <javascript:>> wrote: > > > Hello, > > > > > > I've tested the config, it doesn't work. > > > > > > I haven't tested the profile settings, I was aiming to manage clients in > > a > > > different way. > > > I have a hypervisor with ~100 VM's on it, if I could differentiate the > > OSSEC > > > config based on the name I wouldn't have to worry about setting a > > profile. > > > > > > Is this feature planned by any chance? > > > > > > > It might be a post-lunchtime haze, but I don't understand the feature > > you're describing. > > > > > > > > terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre > > > escreveu: > > >> > > >> Hello, > > >> > > >> Is it possible to define a profile based on "name" filtered by regex? > > >> In documentation we have: > > >> > > >> > > >> <agent_config name="agent1"> > > >> <localfile> > > >> <location>/var/log/my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> <agent_config os="Linux"> > > >> <localfile> > > >> <location>/var/log/my.log2</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> <agent_config os="Windows"> > > >> <localfile> > > >> <location>C:\myapp\my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> > > >> > > >> Can i use something like this? > > >> > > >> > > >> <agent_config name="REGEX"> > > >> <localfile> > > >> <location>/var/log/my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> > > >> <agent_config os="Linux"> > > >> <localfile> > > >> <location>/var/log/my.log2</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> <agent_config os="Windows"> > > >> <localfile> > > >> <location>C:\myapp\my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> > > >> Thanks for your time. > > >> > > > > > > terça-feira, 10 de Fevereiro de 2015 às 12:00:16 UTC, Ricardo Perre > > > escreveu: > > >> > > >> Hello, > > >> > > >> Is it possible to define a profile based on "name" filtered by regex? > > >> In documentation we have: > > >> > > >> > > >> <agent_config name="agent1"> > > >> <localfile> > > >> <location>/var/log/my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> <agent_config os="Linux"> > > >> <localfile> > > >> <location>/var/log/my.log2</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> <agent_config os="Windows"> > > >> <localfile> > > >> <location>C:\myapp\my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> > > >> > > >> Can i use something like this? > > >> > > >> > > >> <agent_config name="REGEX"> > > >> <localfile> > > >> <location>/var/log/my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> > > >> <agent_config os="Linux"> > > >> <localfile> > > >> <location>/var/log/my.log2</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> <agent_config os="Windows"> > > >> <localfile> > > >> <location>C:\myapp\my.log</location> > > >> <log_format>syslog</log_format> > > >> </localfile> > > >> </agent_config> > > >> > > >> > > >> Thanks for your time. > > >> -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
