On Tue, Nov 14, 2017 at 8:53 AM, amar haq <[email protected]> wrote: > Dear All > > Could OSSEC perform syscheck for File Integration Monitoring on specific > agent. let's say I have 5 servers.Server A,B,C,D,E. > on server A , I just want to monitor /var/www/html/Demo/demo.db.
In server A's ossec.conf, include a <directories> entry for this. > on server B, i want to monitor only /ngingx/index.html. On server B, include a <directories> entry for this. > on Server C, i want to monitor /var/www/html/XYZ.xx, etc On server C include a <directories> entry for this. Alternatively, you can include these in the agent.conf. There is a way to limit it to specific agents, but I can't remember the specifics off hand. > > > could you help me? because I read that Active rsponse have <agent_id> tag to > define specific agent. > I'm not sure what active response has to do with the syscheck questions. > thankyou. > Amar. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
