On Jul 17, 2015 6:26 AM, "Oleg Makarov" <[email protected]> wrote: > > Hello everyone! > I'm a newbie in ossec and I need some help. > I have an ossec manager and 20+ ossec agents. > On manager i have next conf: http://pastebin.com/4LTYNmYH > On agent i have next conf: http://pastebin.com/RzN5p6Zf > I want to see how i change /etc/ssh/sshd_config on one of my agents, I made some changes, but there are no alerts on my email. > What am I do wrong? > Thanks! >
Is the agent connected to the manager? Is the entry in the ayscheck db updated (/var/ossec/queue/syscheck)? The frequency seems very low on the agent. I haven't seen much success with very low frequencies. > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
