hi list i have a quick architecture questions. i saw, that there are much less informations in the ossec.conf from the agent as in the server. Does the agent takes the ossec.conf from the server to do all tests? What have i to do, when some agents need to check some logfiles which aren't on the server? is there a chance to have a customized client, or do i have to configure all on the server and the agents will get the ossec.conf from the server?
I saw in the ossec.conf, that there are some global rules, are there also local rules possible? regards, Dan
