Hello Chema, Thank you for the link I didn’t find before. It is crystal clear.
Cordialement / Regards Sylvain Crouet Security Officer - Security is everybody’s responsibility Mobile +33 (0) 7 75 24 10 28 From: [email protected] [mailto:[email protected]] On Behalf Of Chema Martinez Sent: lundi 20 novembre 2017 16:33 To: [email protected] Subject: Re: [ossec-list] Centralized configuration for Windows agents Hello Sylvain, As you have said, the ossec.conf file is populated with a default configuration when you install the Windows agent. However, this default configuration is never going to have any conflict due to the agent.conf and the ossec.conf are merged. During that merge, the agent.conf overwrites all the settings with a unique value allowed while settings with paths to files are concatenated. In the following documentation, you could find more information about the centralized configuration. https://documentation.wazuh.com/current/user-manual/reference/centralized-configuration.html I hope it helps, Best regards. On Mon, Nov 20, 2017 at 2:52 PM, Sylvain Crouet <[email protected]<mailto:[email protected]>> wrote: Hello, I set OSSEC up to have a centralized agent configuration for Windows agents. As far as I understand, there must be no duplicate between the ossec.conf file and the agent.conf file locally on the agent. Unfortunately, when I install the agent with the .exe installer, the ossec.conf file is already populated with a default configuration. How can I avoid this? Cordialement / Kind regards Sylvain Crouet Security Officer - Security is everybody’s responsibility Mobile +33 (0) 7 75 24 10 28<tel:+33%207%2075%2024%2010%2028> [Logo-Neocase-RGB-TM-TAGLINE-mail-signature] Neocase™ Software is a leading provider of integrated HR and Finance service delivery solutions. www.neocasesoftware.com<http://www.neocasesoftware.com/> [workday_azure_partners_300dpi_1cm5] -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
