IP is used in OSSEC for assigning permissions to agents. It would be possible to add information about the IP address in the agent's queue and show it with *agent_control*, or include the IP in the alert generated when an agent connects to the manager.
Another solution that won't imply to modify the OSSEC code is using a script to log the agent's IP and configuring OSSEC to read it and generate an alert when that IP changes. Anyway, if you use "any" as IP address on registering agents is because you use DHCP and that IP is dynamic, so the IP address would be informative data, never used to identify an agent. Best regards. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
