[ossec-list] Re: regex in agent id field

[Sean Roe]

Thanks,

I think I will be using the profiles option.

Sean

On Friday, December 9, 2016 at 2:56:19 AM UTC-7, Jesus Linares wrote:
>
> Hi Sean,
>
> it seems that agent_config name 
>  is 
> checked by the function OS_Match2 
>  
> which 
> only matches strings with *^*, *$* or *|* special characters. So, you can 
> not use regex in the name.
>
> I recommend you to use profiles in your agents, define your production 
> servers with the profile "production", the development server with "dev" 
> and so on.
>
> Example:
>
> *production agent*
>
> 
>   
> 10.0.0.220
> centos, centos7, production
>   
>
>
> *agent.conf*
> 
>
> I hope it helps.
> Regards.
>
> On Monday, December 5, 2016 at 11:33:01 PM UTC+1, Sean Roe wrote:
>>
>> Hi All,
>>
>> new to this list and I have a question:
>>
>> will the agent_config name field except regex expressions?
>>
>> I found a post by Daniel Cid with this reference: 
>> 
>> 
>> /var/log/my.log
>> syslog
>> 
>> 
>>
>> so I was hoping to build a stanza in agent.conf like this:
>>
>> 
>>  
>> blah, blah.
>>
>> to get the prodAB002, prodCD002, devDD002, qaQQ002 servers
>>
>> Is that doable?
>>
>> Sean
>>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[ossec-list] Re: regex in agent id field

[Jesus Linares]

Hi Sean,

it seems that agent_config name 
 is 
checked by the function OS_Match2 
 which 
only matches strings with *^*, *$* or *|* special characters. So, you can 
not use regex in the name.

I recommend you to use profiles in your agents, define your production 
servers with the profile "production", the development server with "dev" 
and so on.

Example:

*production agent*


  
10.0.0.220
centos, centos7, production
  


*agent.conf*


I hope it helps.
Regards.

On Monday, December 5, 2016 at 11:33:01 PM UTC+1, Sean Roe wrote:
>
> Hi All,
>
> new to this list and I have a question:
>
> will the agent_config name field except regex expressions?
>
> I found a post by Daniel Cid with this reference: 
> 
> 
> /var/log/my.log
> syslog
> 
> 
>
> so I was hoping to build a stanza in agent.conf like this:
>
> 
>  
> blah, blah.
>
> to get the prodAB002, prodCD002, devDD002, qaQQ002 servers
>
> Is that doable?
>
> Sean
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.