On Mon, Nov 26, 2012 at 9:21 AM, rezgui mohamed <rezgui...@gmail.com> wrote: > so on the background ossec server connect through ssh to the remote machine > then start the agent
No. Why would it use SSH? The server and the agent already communicate. The OSSEC server will trigger a restart of the OSSEC processes on the agent (if active response is enabled). I guess if the documentation for this program is THIS bad, I have a lot of work to do. Are there any specific parts of the documentation that make this so difficult to understand?
