Hi, The best way to start just the ones you need is to disabled them at ossec.conf, that way the won't boot, for example for "exced" you can disable Active-response and that will be enough to not boot that daemon.
Regarding to change chroot directory, you are right, each binary has a "-D" option to change it but in my experience not always works as expected, the default folder "/var/ossec" is hardcoded some times and that causes some incompatibilities when change chroot folder, what experiences did you have so far? Regards, Pedro S. On Sun, Oct 30, 2016 at 11:19 PM, Eponymous - <[email protected]> wrote: > Hi, > > I've been looking through the documentation and I can't find a way to > specify a different chroot directory in a configuration file. > > So far I've been looking at which services ossec-control starts when you > issue a "bin/ossec-control start" command and then just starting each one > individually with the -D option to change the chroot directory. > > Is there a better way to do it? Also, if I'm starting the services > manually, is it ok to just start the ones I think I need? For example, I > don't use active-response so can I leave out "execd"? > > Thanks > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
