Hello,
This is the only thread about agentless frequency and start time. What I
have seen is that start time is not available, you receive an error when
you try to set it in ossec.conf in <type>ssh_integrity_check_linux</type>.
What I observe though is the following:
I have 2-3 hosts to run agentless ssh_integrity_check_linux. I need to run
the scan in different times. One needs to run at 1:30 every night, another
needs to run every 30 seconds. My current configuration in ossec.conf:
<agentless>
<type>ssh_integrity_check_linux</type>
<frequency>30</frequency>
<host>[email protected]</host>
<state>periodic</state>
<arguments>/bin /etc /sbin</arguments>
<type>ssh_integrity_check_linux</type>
<frequency>86400</frequency>
<host>[email protected]</host>
<state>periodic</state>
<arguments>/bin</arguments>
</agentless>
Is there a way to run the second scan at a specific time? I have thought of
a workaround to restart ossec at 1:30, but I will later add another system
that I need to scan daily at 4:00. How can this be done?
Additionally, if you set different frequencies per host, only the longest
one works, i.e. 86400 above. Is this a bug, or do you see something wrong?
I would appreciate your answer.
Thank you,
Dimitris.
On Tuesday, July 9, 2013 at 5:27:15 PM UTC+3, Adam wrote:
>
> Hello,
>
> When setting a frequency for agentless scanning, does this work as 18600
> seconds say from the last time the agentless script was started, or from
> when it was finished and analysed?
>
> Also is there an equivalent to the <scan_time><scan_day> for syscheck for
> kicking of agentless scripts? (If not, could I suggest it for a future
> feature).
>
> Cheers
> Adam
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
