I did some more research, found that <agent_config profile=”"> might do what I need, but how do I define which machines use which profile? Do I define a block of servers in some profile block? Im still looking at the documentation but Im not finding much info on it.
Thanks, Sean On Monday, October 9, 2017 at 9:55:50 AM UTC-7, Sean Roe wrote: > > Hi All, > > I have been looking for documentation on how to break up out ignores based > on server name: > > example: > > our prod servers all start with m1xxxxx.blah.blah > our dev servers all start with g1xxxxx.blah.blah > our QA servers all start with t5xxxxx.blah.blah > > (dont ask me, I didnt come up with the names). > > So for m1 servers we would like to have one set of ignores/excludes > for g1 a different set, and for t5 pretty much dont care what gets changed > as it changes all the time. > > Is there a way to do this and can somebody point me to the right docs? > btw we are using the wazuh install. > > Thanks, > Sean > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
