Yea... multiple agents for a single AR doesn't work. Although, this would be a very nice feature to offer in the future :) I currently want to apply a single AR to only a group of my [many] agents. In the meantime, I'll probably have to create separate entries for each agent.
On Nov 29, 11:58 am, "dan (ddp)" <ddp...@gmail.com> wrote: > I'm pretty sure you cannot use multiple agent_ids in a single AR. Your > best bet might be to run the AR on all agents... > > On Thu, Nov 11, 2010 at 11:54 AM, benfellows <benfell...@gmail.com> wrote: > > Active response stopped working when we failed over to our other > > firewall. Here is my Active Response configuration – it was working > > fine for agent 016 – but it is not working for agent 008. Is my syntax > > wrong here? Can I put multiple agent IDs in the same active response? > > (i.e. like <agent_id>008,016</agent_id>) > > > <active-response> > > <command>firewall-drop</command> > > <location>defined-agent</location> > > <agent_id>016</agent_id> > > <rules_id>5712</rules_id> > > <timeout>600</timeout> > > </active-response> > > > <active-response> > > <command>firewall-drop</command> > > <location>defined-agent</location> > > <agent_id>016</agent_id> > > <rules_id>11451</rules_id> > > <timeout>600</timeout> > > </active-response> > > > <active-response> > > <command>firewall-drop</command> > > <location>defined-agent</location> > > <agent_id>008</agent_id> > > <rules_id>5712</rules_id> > > <timeout>600</timeout> > > </active-response> > > > <active-response> > > <command>firewall-drop</command> > > <location>defined-agent</location> > > <agent_id>008</agent_id> > > <rules_id>11451</rules_id> > > <timeout>600</timeout> > > </active-response> > > > Ben > >
