On Tue, Mar 13, 2018 at 4:40 AM, Igor <6513...@gmail.com> wrote: > I have edit /var/ossec/etc/ossec.conf on a client > > <!-- OSSEC example config --> > > <ossec_config> > <client> > <server-ip>my_ip</server-ip> > </client> > </ossec_config> > > and get this error > > Started ossec-agentd... > 2018/03/13 11:33:40 ossec-logcollector: Remote commands are not accepted > from the manager. Ignoring it on the agent.conf > 2018/03/13 11:33:40 ossec-logcollector(1202): ERROR: Configuration error at > '/var/ossec/etc/shared/agent.conf'. Exiting.
If you have commands in your agent.conf, you need to set "logcollector.remote_commands" to "1" in internal_options.conf. https://ossec.github.io/docs/syntax/head_internal_options.analysisd.html?highlight=remote%20command#intopt-logcollector.remote_commands=0 > Started ossec-logcollector... > Started ossec-syscheckd... > Completed. > > File /var/ossec/etc/shared/agent.conf placed on client and on server, they > are the same and client get config from server. > > how client get config? > 1 - local /var/ossec/etc/ossec.conf, > 2 - local /var/ossec/etc/shared/agent.conf > 3 - server /var/ossec/etc/shared/agent.conf > ? Clients use "/var/ossec/etc/ossec.conf" and "/var/ossec/etc/shared/agent.conf." The agent.conf comes from the server. Some configurations can be set in the agent.conf, but not all. Unfortunately there isn't a good list of which works where. > how can i resolv this error ossec-logcollector(1202): ERROR? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
