Should we expect to be solved in the forthcoming ossec release?
El viernes, 29 de enero de 2016, 20:17:46 (UTC+1), Daniel Cid escribió:
>
> Awesome :)
>
> On Fri, Jan 29, 2016 at 3:06 PM, Luke Hansey > wrote:
>
>> Works great now. Thank you for the work on this. No worries about the
>> time.
Hi,
I have an OSSEC Server receiving IIS logs from several servers via agent
configuration:
ex:
* PATH/W3SVCx/u_ex%y%m%d%H.log
iis *
Everything works like a charm. However, some of my IIS logs are longer than
usual (more than 1256 chars long). When this happens, Alerts are equally
Hi,
what should be the approach to delete all agent and respected entries to
start from scratch ?
I have a ossec server and 50+ agents which was in 'inactive' state. I
decided to upgrade the server and client version (start as fresh). I moved
client.keys and all files from rids directory and
Answering my own question.. it would probably make the most sense to
install two agents on a host.. each reporting to a different master.
Cheers,
Clay
On Saturday, January 30, 2016 at 11:16:13 AM UTC-5, Clay Wells wrote:
>
> Hi,
>
> Is it possible for one agent report to report to two masters?
>
I think it's possible, you just have to have the server block listed twice,
and use the same key on both servers.
- Untested on my end.
On Saturday, January 30, 2016 at 10:16:13 AM UTC-6, Clay Wells wrote:
>
> Hi,
>
> Is it possible for one agent report to report to two masters?
>
> Some sysadmi
