Hello All, Need some help. I am trying out ossec with Security Onion. The ossec server comes preinstalled in Security Onion. I am now trying the agent piece. I installed the v2.9.2 latest version agent on one of my Windows client pc's, did the initial config and restarted the agent. From the ossec server, the agent ID shows connected. So far so good.
I then created the "/var/ossec/etc/shared/agent.conf" on the server, put in a stanza for "os=windows" , saved the file and restarted the ossec server. After waiting for a while, I checked the client PC & the agent.conf didn't get created / deployed to the client. Infact, the agent logs on client were showing this error message" XML Error /shared/agent.conf not found" So i then went ahead and created the agent.conf manually on my client and restarted the service again. The above XML error didn't show up this time but even after waiting for 15 mins or so, the agent.conf is empty. It is not downloading / syncing the changes from the agent.conf that's on the ossec server. what could the reason be ? Any help appreciated ================================================= Here is the result of md5check command: sudo /var/ossec/bin/agent_control -i 001 OSSEC HIDS agent_control. Agent information: Agent ID: 001 Agent Name: ENGG-WKS IP address: 172.16.3.10 Status: Active Operating system: Microsoft Windows 7 Business Edition Professional Se.. Client version: OSSEC HIDS v2.9.2 / d41d8cd98f00b204e9800998ecf8427e Last keep alive: Thu Mar 29 20:20:40 2018 root@securityonion:# md5sum /var/ossec/etc/shared/agent.conf 9e4fb5a9b0ea944c19cedab71e860b54 /var/ossec/etc/shared/agent.conf Both checksums are different. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
