On Fri, Feb 1, 2019 at 7:28 AM dan (ddp) <[email protected]> wrote: > > On Mon, Jan 21, 2019 at 4:44 PM Don Hall <[email protected]> wrote: > > > > I am configuring OSSEC and have to monitor different agents, residing on > > different servers. > > > > > > > > How can I define the directories to monitor for every agent id or every > > server that OSSEC is monitoring, > > > > In my environment? > > > > > > Syscheck or log collector? >
After thinking about it, I guess this only makes sense for syscheck. So in the <syscheck> section, add: <directories check_all="yes">DIRECTORY1,DIRECTORY2,DIRECTORY3</directories> in the ossec.conf and restart the ossec processes. > > > > If you could please send config file snippets or ossec.conf examples that > > do such, > > > > It would be a great template, to use for the multiple agents. > > > > > > > > Regards, > > > > > > > > > > > > Don Hall > > > > Network Admin > > > > RMS > > > > > > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [email protected]. > > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
