On Tue, Mar 13, 2018 at 9:33 AM, Igor <6513...@gmail.com> wrote: > > > вторник, 13 марта 2018 г., 16:20:58 UTC+3 пользователь Igor написал: >> >> >>> >>> If you have commands in your agent.conf, you need to set >>> "logcollector.remote_commands" to "1" in internal_options.conf. >>> >>> https://ossec.github.io/docs/syntax/head_internal_options.analysisd.html?highlight=remote%20command#intopt-logcollector.remote_commands=0 >>> >> now i have logcollector.remote_commands=0, so which is mean that my >> client use agent.conf from server? >> i have agent.conf on a client to, is it apply to client? > > > whith 0 and 1 client use local config /var/ossec/etc/shared/agent.conf not > from server
logcollector.remote_commands=1 only allows commands to be defined in /var/ossec/etc/shared/agent.conf. If this is set to 1, all commands must be set in the ossec.conf. The agent.conf comes from the server. If you modify /var/ossec/etc/shared/agent.conf on the server, it will eventually be pushed to the agents. After it is pushed, a restart of the agents will allow those changes to be used. >>> >>> >>> Clients use "/var/ossec/etc/ossec.conf" and >>> "/var/ossec/etc/shared/agent.conf." >>> The agent.conf comes from the server. >>> Some configurations can be set in the agent.conf, but not all. >>> Unfortunately there >>> isn't a good list of which works where. >>> >>> >>> > how can i resolv this error ossec-logcollector(1202): ERROR? >> >> >>> >>> So this error, how can i resolv? > > > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
