On Jun 8, 5:27 am, "dan (ddp)" wrote:
> 2. Every client gets the entire agent.conf, and only uses the parts
> that apply to that system.
Does that mean it's strictly additive, so that checks already defined
in a client's ossec.conf cannot be removed by omission from server's
agent.conf?
For audi
Is there a way to list the final configuration that is being used by
the agent (after combining ossec.conf and agent.conf)?
Thanks,
Antony.
I see the files/directories that are being monitored logged in the
ossec.log file. It also reports about duplicate entries between
ossec.conf and agent.conf entries. It doesn't log the 'ignore'
entries though. It will be good if this can be added to the log
during the agent start up.
Thanks,
Ant
On Tue, Jun 8, 2010 at 8:14 PM, dp wrote:
> On Jun 8, 5:27 am, "dan (ddp)" wrote:
>
>> 2. Every client gets the entire agent.conf, and only uses the parts
>> that apply to that system.
>
> Does that mean it's strictly additive, so that checks already defined
> in a client's ossec.conf cannot be r
