Problem is, I have some agent_configs that I moved from the general (puppet-managed) ossec.conf file, into the shared agent.conf file. When the configs were in the ossrc.conf file, they used to generate a lot of email (monitoring errors that appear in log files mostly). Now that they are in the agent.conf file, there is no more activity. How can I force (or make) ossec-hids read the agent.conf file?
On Wednesday, August 26, 2015 at 2:40:13 PM UTC+1, dan (ddpbsd) wrote: > > On Wed, Aug 26, 2015 at 9:20 AM, <notif...@gmail.com <javascript:>> > wrote: > > I suppose you are correct, but I have both ossec.conf and > shared/agent.conf > > on > > each serve, and they both have different configuration (the agent.conf > has > > <agent_config> values inside of it? > > Which one of them does ossec depend on? > > ossec.conf is required, agent.conf is optional. Both configurations are > used. > > > I must note that I installed these from the atomic repo onto RHEL and > CentOS > > machines. > > > > I am grateful for any illumination. > > > > On Wednesday, August 26, 2015 at 1:20:53 PM UTC+1, dan (ddpbsd) wrote: > >> > >> On Wed, Aug 26, 2015 at 7:38 AM, <notif...@gmail.com> wrote: > >> > Hi! > >> > > >> > Is it a good idea to use shared agent.conf and local agent.confs? > >> > I have puppet managing an agent.conf file for all my client machines > >> > before > >> > I discovered > >> > using the shared agent.conf. > >> > Can they be used together, and if so, how? > >> > > >> > >> Isn't ossec.conf basically the local agent.conf? > >> > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups > >> > "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, > send > >> > an > >> > email to ossec-list+...@googlegroups.com. > >> > For more options, visit https://groups.google.com/d/optout. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to ossec-list+...@googlegroups.com <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
