On Tue, Nov 3, 2015 at 8:28 AM, Dimitris <[email protected]> wrote:
> Hello,
>
> This is the only thread about agentless frequency and start time. What I
> have seen is that start time is not available, you receive an error when you
> try to set it in ossec.conf in  <type>ssh_integrity_check_linux</type>. What
> I observe though is the following:
>
> I have 2-3 hosts to run agentless ssh_integrity_check_linux. I need to run
> the scan in different times. One needs to run at 1:30 every night, another
> needs to run every 30 seconds. My current configuration in ossec.conf:
> <agentless>
>       <type>ssh_integrity_check_linux</type>
>       <frequency>30</frequency>

That's super ambitious.

>       <host>[email protected]</host>
>       <state>periodic</state>
>       <arguments>/bin /etc /sbin</arguments>
>
>      <type>ssh_integrity_check_linux</type>
>       <frequency>86400</frequency>
>       <host>[email protected]</host>
>       <state>periodic</state>
>       <arguments>/bin</arguments>
> </agentless>
>
> Is there a way to run the second scan at a specific time? I have thought of
> a workaround to restart ossec at 1:30, but I will later add another system
> that I need to scan daily at 4:00. How can this be done?
>

I'm not aware of a way to run the commands at a specified time. If
it's not in the documentation, it probably doesn't exist.

> Additionally, if you set different frequencies per host, only the longest
> one works, i.e. 86400 above. Is this a bug, or do you see something wrong?
>

I don't use the agentless stuff, so I don't know how much help I can
be. But have you tried using 2 <agentless> blocks instead of 1? It
could be a stupid idea, but again I don't use it.

> I would appreciate your answer.
>
> Thank you,
> Dimitris.
>
>
>
> On Tuesday, July 9, 2013 at 5:27:15 PM UTC+3, Adam wrote:
>>
>> Hello,
>>
>> When setting a frequency for agentless scanning, does this work as 18600
>> seconds say from the last time the agentless script was started, or from
>> when it was finished and analysed?
>>
>> Also is there an equivalent to the <scan_time><scan_day> for syscheck for
>> kicking of agentless scripts? (If not, could I suggest it for a future
>> feature).
>>
>> Cheers
>> Adam
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to