On Sep 2, 2015 8:18 AM, "Sina Owolabi" <notify.s...@gmail.com> wrote: > > Yes. The agents names are also their hostnames. >
Besides the other thing I listed, check to make sure the agents are getting the agent.conf and that the ossec processes are restarted when they do. > > > Sent using CloudMagic > On Wed, Sep 02, 2015 at 12:59 PM, dan (ddp) <ddp...@gmail.com> wrote: > >> On Tue, Sep 1, 2015 at 10:50 PM, Sina Owolabi <notify.s...@gmail.com> wrote: >> > Yes, there are blocks that apply to the agents I have created specific >> > configurations for, and I sectioned them off with the full name of the >> > agent(s). >> >> These are the agent names, and not hostnames, correct? >> >> > Please, are these agent.conf sections in order? I just added it to >> > what already exists in the file: >> > >> >> I don't believe they need to be in any specific order. >> >> >> > <agent_config name="wubly.corpdomain.lala"> >> > <!-- wubly logs --> >> > <localfile> >> > <location>/opt/wubly/src/wubly/logs/*/*.log</location> >> >> I believe, in the ossec.log file, you should see entries about OSSEC >> monitoring these log files. Do you see them? If not, try adding a >> specific logfile instead of using the glob and check again for that >> specific log file. >> >> > <log_format>syslog</log_format> >> > </localfile> >> > <directories realtime="yes" >> > check_all="yes">/root,/etc/httpd,/usr/share/tomcat6,/usr/share/tomcat7,/var/log/ >> > httpd,/opt/wubly/ve/src/wubly/configFiles</directories> >> > </agent_config> >> > >> > <agent_config name="canny2.corpdomain.lala"> >> > <!-- wubly logs --> >> > <localfile> >> > <location>/opt/wubly/wubly/logs/*/*.log</location> >> > <log_format>syslog</log_format> >> > </localfile> >> > <directories realtime="yes" >> > check_all="yes">/root,/etc/httpd,/usr/share/tomcat6,/usr/share/tomcat7,/var/log/ >> > httpd,/opt/wubly/wubly/configFiles</directories> >> > </agent_config> >> > >> > <agent_config name="testor.testing.corpdomain.lala"> >> > <localfile> >> > <log_format>apache</log_format> >> > <location>/var/log/stratus-ussd-customer/stratus.log</location> >> > </localfile> >> > </agent_config> >> > >> > On Tue, Sep 1, 2015 at 2:37 AM, dan (ddp) <ddp...@gmail.com> wrote: >> >> On Thu, Aug 27, 2015 at 5:14 PM, <notify.s...@gmail.com> wrote: >> >>> Problem is, I have some agent_configs that I moved from the general >> >>> (puppet-managed) ossec.conf file, >> >>> into the shared agent.conf file. >> >>> When the configs were in the ossrc.conf file, they used to generate a lot of >> >>> email (monitoring errors that >> >>> appear in log files mostly). >> >>> Now that they are in the agent.conf file, there is no more activity. >> >>> How can I force (or make) ossec-hids read the agent.conf file? >> >>> >> >> >> >> If the file exists, and is readable, it should be used. Of course, >> >> that assumes there is a block inside it that applies to that agent. >> >> >> >>> >> >>> On Wednesday, August 26, 2015 at 2:40:13 PM UTC+1, dan (ddpbsd) wrote: >> >>>> >> >>>> On Wed, Aug 26, 2015 at 9:20 AM, <notif...@gmail.com> wrote: >> >>>> > I suppose you are correct, but I have both ossec.conf and >> >>>> > shared/agent.conf >> >>>> > on >> >>>> > each serve, and they both have different configuration (the agent.conf >> >>>> > has >> >>>> > <agent_config> values inside of it? >> >>>> > Which one of them does ossec depend on? >> >>>> >> >>>> ossec.conf is required, agent.conf is optional. Both configurations are >> >>>> used. >> >>>> >> >>>> > I must note that I installed these from the atomic repo onto RHEL and >> >>>> > CentOS >> >>>> > machines. >> >>>> > >> >>>> > I am grateful for any illumination. >> >>>> > >> >>>> > On Wednesday, August 26, 2015 at 1:20:53 PM UTC+1, dan (ddpbsd) wrote: >> >>>> >> >> >>>> >> On Wed, Aug 26, 2015 at 7:38 AM, <notif...@gmail.com> wrote: >> >>>> >> > Hi! >> >>>> >> > >> >>>> >> > Is it a good idea to use shared agent.conf and local agent.confs? >> >>>> >> > I have puppet managing an agent.conf file for all my client machines >> >>>> >> > before >> >>>> >> > I discovered >> >>>> >> > using the shared agent.conf. >> >>>> >> > Can they be used together, and if so, how? >> >>>> >> > >> >>>> >> >> >>>> >> Isn't ossec.conf basically the local agent.conf? >> >>>> >> >> >>>> >> > >> >>>> >> > -- >> >>>> >> > >> >>>> >> > --- >> >>>> >> > You received this message because you are subscribed to the Google >> >>>> >> > Groups >> >>>> >> > "ossec-list" group. >> >>>> >> > To unsubscribe from this group and stop receiving emails from it, >> >>>> >> > send >> >>>> >> > an >> >>>> >> > email to ossec-list+...@googlegroups.com. >> >>>> >> > For more options, visit https://groups.google.com/d/optout. >> >>>> > >> >>>> > -- >> >>>> > >> >>>> > --- >> >>>> > You received this message because you are subscribed to the Google >> >>>> > Groups >> >>>> > "ossec-list" group. >> >>>> > To unsubscribe from this group and stop receiving emails from it, send >> >>>> > an >> >>>> > email to ossec-list+...@googlegroups.com. >> >>>> > For more options, visit https://groups.google.com/d/optout. >> >>> >> >>> -- >> >>> >> >>> --- >> >>> You received this message because you are subscribed to the Google Groups >> >>> "ossec-list" group. >> >>> To unsubscribe from this group and stop receiving emails from it, send an >> >>> email to ossec-list+unsubscr...@googlegroups.com. >> >>> For more options, visit https://groups.google.com/d/optout. >> >> >> >> -- >> >> >> >> --- >> >> You received this message because you are subscribed to the Google Groups "ossec-list" group. >> >> To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. >> >> For more options, visit https://groups.google.com/d/optout. >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. >> > For more options, visit https://groups.google.com/d/optout. >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. >> For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
