On Thu, Aug 27, 2015 at 5:14 PM, <notify.s...@gmail.com> wrote: > Problem is, I have some agent_configs that I moved from the general > (puppet-managed) ossec.conf file, > into the shared agent.conf file. > When the configs were in the ossrc.conf file, they used to generate a lot of > email (monitoring errors that > appear in log files mostly). > Now that they are in the agent.conf file, there is no more activity. > How can I force (or make) ossec-hids read the agent.conf file? >
If the file exists, and is readable, it should be used. Of course, that assumes there is a block inside it that applies to that agent. > > On Wednesday, August 26, 2015 at 2:40:13 PM UTC+1, dan (ddpbsd) wrote: >> >> On Wed, Aug 26, 2015 at 9:20 AM, <notif...@gmail.com> wrote: >> > I suppose you are correct, but I have both ossec.conf and >> > shared/agent.conf >> > on >> > each serve, and they both have different configuration (the agent.conf >> > has >> > <agent_config> values inside of it? >> > Which one of them does ossec depend on? >> >> ossec.conf is required, agent.conf is optional. Both configurations are >> used. >> >> > I must note that I installed these from the atomic repo onto RHEL and >> > CentOS >> > machines. >> > >> > I am grateful for any illumination. >> > >> > On Wednesday, August 26, 2015 at 1:20:53 PM UTC+1, dan (ddpbsd) wrote: >> >> >> >> On Wed, Aug 26, 2015 at 7:38 AM, <notif...@gmail.com> wrote: >> >> > Hi! >> >> > >> >> > Is it a good idea to use shared agent.conf and local agent.confs? >> >> > I have puppet managing an agent.conf file for all my client machines >> >> > before >> >> > I discovered >> >> > using the shared agent.conf. >> >> > Can they be used together, and if so, how? >> >> > >> >> >> >> Isn't ossec.conf basically the local agent.conf? >> >> >> >> > >> >> > -- >> >> > >> >> > --- >> >> > You received this message because you are subscribed to the Google >> >> > Groups >> >> > "ossec-list" group. >> >> > To unsubscribe from this group and stop receiving emails from it, >> >> > send >> >> > an >> >> > email to ossec-list+...@googlegroups.com. >> >> > For more options, visit https://groups.google.com/d/optout. >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to ossec-list+...@googlegroups.com. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
