Yes, there are blocks that apply to the agents I have created specific
configurations for, and I sectioned them off with the full name of the
agent(s).
Please, are these agent.conf sections in order? I just added it to
what already exists in the file:
<agent_config name="wubly.corpdomain.lala">
<!-- wubly logs -->
<localfile>
<location>/opt/wubly/src/wubly/logs/*/*.log</location>
<log_format>syslog</log_format>
</localfile>
<directories realtime="yes"
check_all="yes">/root,/etc/httpd,/usr/share/tomcat6,/usr/share/tomcat7,/var/log/
httpd,/opt/wubly/ve/src/wubly/configFiles</directories>
</agent_config>
<agent_config name="canny2.corpdomain.lala">
<!-- wubly logs -->
<localfile>
<location>/opt/wubly/wubly/logs/*/*.log</location>
<log_format>syslog</log_format>
</localfile>
<directories realtime="yes"
check_all="yes">/root,/etc/httpd,/usr/share/tomcat6,/usr/share/tomcat7,/var/log/
httpd,/opt/wubly/wubly/configFiles</directories>
</agent_config>
<agent_config name="testor.testing.corpdomain.lala">
<localfile>
<log_format>apache</log_format>
<location>/var/log/stratus-ussd-customer/stratus.log</location>
</localfile>
</agent_config>
On Tue, Sep 1, 2015 at 2:37 AM, dan (ddp) <ddp...@gmail.com> wrote:
> On Thu, Aug 27, 2015 at 5:14 PM, <notify.s...@gmail.com> wrote:
>> Problem is, I have some agent_configs that I moved from the general
>> (puppet-managed) ossec.conf file,
>> into the shared agent.conf file.
>> When the configs were in the ossrc.conf file, they used to generate a lot of
>> email (monitoring errors that
>> appear in log files mostly).
>> Now that they are in the agent.conf file, there is no more activity.
>> How can I force (or make) ossec-hids read the agent.conf file?
>>
>
> If the file exists, and is readable, it should be used. Of course,
> that assumes there is a block inside it that applies to that agent.
>
>>
>> On Wednesday, August 26, 2015 at 2:40:13 PM UTC+1, dan (ddpbsd) wrote:
>>>
>>> On Wed, Aug 26, 2015 at 9:20 AM, <notif...@gmail.com> wrote:
>>> > I suppose you are correct, but I have both ossec.conf and
>>> > shared/agent.conf
>>> > on
>>> > each serve, and they both have different configuration (the agent.conf
>>> > has
>>> > <agent_config> values inside of it?
>>> > Which one of them does ossec depend on?
>>>
>>> ossec.conf is required, agent.conf is optional. Both configurations are
>>> used.
>>>
>>> > I must note that I installed these from the atomic repo onto RHEL and
>>> > CentOS
>>> > machines.
>>> >
>>> > I am grateful for any illumination.
>>> >
>>> > On Wednesday, August 26, 2015 at 1:20:53 PM UTC+1, dan (ddpbsd) wrote:
>>> >>
>>> >> On Wed, Aug 26, 2015 at 7:38 AM, <notif...@gmail.com> wrote:
>>> >> > Hi!
>>> >> >
>>> >> > Is it a good idea to use shared agent.conf and local agent.confs?
>>> >> > I have puppet managing an agent.conf file for all my client machines
>>> >> > before
>>> >> > I discovered
>>> >> > using the shared agent.conf.
>>> >> > Can they be used together, and if so, how?
>>> >> >
>>> >>
>>> >> Isn't ossec.conf basically the local agent.conf?
>>> >>
>>> >> >
>>> >> > --
>>> >> >
>>> >> > ---
>>> >> > You received this message because you are subscribed to the Google
>>> >> > Groups
>>> >> > "ossec-list" group.
>>> >> > To unsubscribe from this group and stop receiving emails from it,
>>> >> > send
>>> >> > an
>>> >> > email to ossec-list+...@googlegroups.com.
>>> >> > For more options, visit https://groups.google.com/d/optout.
>>> >
>>> > --
>>> >
>>> > ---
>>> > You received this message because you are subscribed to the Google
>>> > Groups
>>> > "ossec-list" group.
>>> > To unsubscribe from this group and stop receiving emails from it, send
>>> > an
>>> > email to ossec-list+...@googlegroups.com.
>>> > For more options, visit https://groups.google.com/d/optout.
>>
>> --
>>
>> ---
>> You received this message because you are subscribed to the Google Groups
>> "ossec-list" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to ossec-list+unsubscr...@googlegroups.com.
>> For more options, visit https://groups.google.com/d/optout.
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
