On Thu, Mar 29, 2018, 4:32 PM Neeraj Shah <[email protected]> wrote:
> Hello All, > > Need some help. I am trying out ossec with Security Onion. The ossec > server comes preinstalled in Security Onion. I am now trying the agent > piece. I installed the v2.9.2 latest version agent on one of my Windows > client pc's, did the initial config and restarted the agent. From the > ossec server, the agent ID shows connected. So far so good. > > I then created the "/var/ossec/etc/shared/default/agent.conf" on the > server, put in a stanza for "os=windows" , saved the file and restarted the > ossec server. After waiting for a while, I checked the client PC & the > agent.conf didn't get created / deployed to the client. Infact, the agent > logs on client were showing this error message" XML Error > /shared/agent.conf not found" > > So i then went ahead and created the agent.conf manually on my client and > restarted the service again. The above XML error didn't show up this time > but even after waiting for 15 mins or so, the agent.conf is empty. It is > not downloading / syncing the changes from the agent.conf that's on the > ossec server. > > what could the reason be ? Any help appreciated > Check permissions on the agent side? Look for the agent.conf contents in merged.mg? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
