On Mar 13, 2018 12:23 PM, "Igor" <6513...@gmail.com> wrote:
вторник, 13 марта 2018 г., 18:08:44 UTC+3 пользователь dan (ddpbsd) написал: > On Tue, Mar 13, 2018 at 9:33 AM, Igor <651...@gmail.com> wrote: > > > > > > вторник, 13 марта 2018 г., 16:20:58 UTC+3 пользователь Igor написал: > >> > >> > >>> > >>> If you have commands in your agent.conf, you need to set > >>> "logcollector.remote_commands" to "1" in internal_options.conf. > >>> > >>> https://ossec.github.io/docs/syntax/head_internal_options.an > alysisd.html?highlight=remote%20command#intopt-logcollector. > remote_commands=0 > >>> > >> now i have logcollector.remote_commands=0, so which is mean that my > >> client use agent.conf from server? > >> i have agent.conf on a client to, is it apply to client? > > > > > > whith 0 and 1 client use local config /var/ossec/etc/shared/agent.conf > not > > from server > > logcollector.remote_commands=1 only allows commands to be defined in > /var/ossec/etc/shared/agent.conf. If this is set to 1, all commands > must be set in the ossec.conf. > > The agent.conf comes from the server. If you modify > /var/ossec/etc/shared/agent.conf on the server, it will eventually be > pushed to the agents. > /var/ossec/etc/shared/agent.conf - on a server side, or on client side? i have same file on client You edit the file on the server. That file then gets pushed to the client. After it is pushed, a restart of the agents will allow those changes to be > used. > > >>> > >>> > >>> Clients use "/var/ossec/etc/ossec.conf" and > >>> "/var/ossec/etc/shared/agent.conf." > >>> The agent.conf comes from the server. > >>> Some configurations can be set in the agent.conf, but not all. > >>> Unfortunately there > >>> isn't a good list of which works where. > >>> > >>> > >>> > how can i resolv this error ossec-logcollector(1202): ERROR? > This ERROR is still present, and not solved. > >> > >> > >>> > >>> So this error, how can i resolv? > > > > > > > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to ossec-list+...@googlegroups.com. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
