http://ossec-docs.readthedocs.org/en/latest/manual/agent/agent-configuration.html I got really excited when I read this page. I made some changes to files being watched and was glad I didn't have to hop around to all the agents and add to the conf files one by one. I edited /var/ossec/etc/shared/agent.conf with my changes, restarted /bin/ossec-control to propagate the changes faster, and let it go for a day. Two days later, checking the md5sum of my local /etc/shared/agent.conf doesn't match any agent client version.
Should I be checking that still? Or is there a different way to check for consistency without logging into an agent box? And where do I start debugging this? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
