On Tue, Nov 3, 2015 at 8:28 AM, Dimitris <[email protected]> wrote: > Hello, > > This is the only thread about agentless frequency and start time. What I > have seen is that start time is not available, you receive an error when you > try to set it in ossec.conf in <type>ssh_integrity_check_linux</type>. What > I observe though is the following: > > I have 2-3 hosts to run agentless ssh_integrity_check_linux. I need to run > the scan in different times. One needs to run at 1:30 every night, another > needs to run every 30 seconds. My current configuration in ossec.conf: > <agentless> > <type>ssh_integrity_check_linux</type> > <frequency>30</frequency>
That's super ambitious. > <host>[email protected]</host> > <state>periodic</state> > <arguments>/bin /etc /sbin</arguments> > > <type>ssh_integrity_check_linux</type> > <frequency>86400</frequency> > <host>[email protected]</host> > <state>periodic</state> > <arguments>/bin</arguments> > </agentless> > > Is there a way to run the second scan at a specific time? I have thought of > a workaround to restart ossec at 1:30, but I will later add another system > that I need to scan daily at 4:00. How can this be done? > I'm not aware of a way to run the commands at a specified time. If it's not in the documentation, it probably doesn't exist. > Additionally, if you set different frequencies per host, only the longest > one works, i.e. 86400 above. Is this a bug, or do you see something wrong? > I don't use the agentless stuff, so I don't know how much help I can be. But have you tried using 2 <agentless> blocks instead of 1? It could be a stupid idea, but again I don't use it. > I would appreciate your answer. > > Thank you, > Dimitris. > > > > On Tuesday, July 9, 2013 at 5:27:15 PM UTC+3, Adam wrote: >> >> Hello, >> >> When setting a frequency for agentless scanning, does this work as 18600 >> seconds say from the last time the agentless script was started, or from >> when it was finished and analysed? >> >> Also is there an equivalent to the <scan_time><scan_day> for syscheck for >> kicking of agentless scripts? (If not, could I suggest it for a future >> feature). >> >> Cheers >> Adam > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
