On Thu, Jan 22, 2015 at 11:01 AM, Thomas Vidal <vidal.tho...@gmail.com> wrote: >> Dear Dan, >> >> Where do you think the bug is? >> Are you sure ossec-execd is running on the agent? > > YES ! >> >> Is AR disabled on the agent or manager? > > There is no <disable>YES</disable> both in ossec.conf and agent.conf (and > normaly following the documentation AR is enable by default) >> >> Can you add some debug logs to the manager and maybe agent to log when > > I set debug=2 everywhere in internal_options.conf on the server and > clients... and I have nothing else related to my problem ! >> >> AR is getting triggered? > > What do you mean ? >
I mean add some debug statements to the code and recompile. I think AR's logging is pretty bad, so I think you'd have to add more logging statements to make it better. > Many thanks for your help. >> >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
