[ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
Hi all, Somebody know if it is possible to do two different installations on the same host, one as an agent and another as a server?? I need to install OSSEC server as a service under three hosts with RedHat Cluster Suite to provide High Availability. At the same time I need to monitor with

RE: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread d.asselin
r and agent at the same time on the same host Hi all, Somebody know if it is possible to do two different installations on the same host, one as an agent and another as a server?? I need to install OSSEC server as a service under three hosts with RedHat Cluster Suite to provide High Availabilit

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 06:44 PM, d.asse...@cgi.com wrote: Hi Have done exacltely that on 3 Solaris servers one is server and agent What steps have you followed? I am thinkin on this: a) Install ossec as a server. b) Remove syscheck, rootcheck and localfile params from ossec.conf on the server

RE: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread d.asselin
this world(corp. security) Good luck Dan -Message d'origine- De : ossec-list@googlegroups.com [mailto:ossec-l...@googlegroups.com] De la part de carlopmart Envoyé : 15 déc. 2010 13:00 À : ossec-list@googlegroups.com Objet : Re: [ossec-list] Server and agent at the same time on the same

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 07:14 PM, d.asse...@cgi.com wrote: And the answer is E But I did remove some functionality from the server side I'm writhing a doc on it for the deployment team But basicali remove In ossec.conf the services you don’t want doubled up But first I installed the server in /opt

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread dan (ddp)
On Wed, Dec 15, 2010 at 1:38 PM, carlopmart wrote: > On 12/15/2010 07:14 PM, d.asse...@cgi.com wrote: >> >>  And the answer is E >> >>   But I did remove some functionality from the server side >> >> I'm writhing a doc on it for the deployment team But basicali remove >> In ossec.conf  the service

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 07:38 PM, carlopmart wrote: Thanks Dan. I have installed ossec as a server disabling rootchek, syscheck and active response. But when I launch ossec init script syscheckd is started. How can I prevent to start syscheckd?? Thanks. Ok, It appears that the agent and the server

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 08:10 PM, dan (ddp) wrote: On Wed, Dec 15, 2010 at 1:38 PM, carlopmart wrote: On 12/15/2010 07:14 PM, d.asse...@cgi.com wrote: And the answer is E But I did remove some functionality from the server side I'm writhing a doc on it for the deployment team But basicali remove

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread loyd. darby
Isn't this kind of cluster issue usually handled by mounting shared storage. That way each server is monitoring local resources but writing to the same ossec log. On 12/15/2010 02:15 PM, carlopmart wrote: On 12/15/2010 08:10 PM, dan (ddp) wrote: On Wed, Dec 15, 2010 at 1:38 PM, carlopmart wr

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread Michael Starks
On Wed, 15 Dec 2010 18:38:23 +0100, carlopmart wrote: Hi all, Somebody know if it is possible to do two different installations on the same host, one as an agent and another as a server?? Sure: http://www.immutablesecurity.com/index.php/2010/10/22/2woo-day-6-running-multiple-instances-on-on

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread dan (ddp)
On Wed, Dec 15, 2010 at 2:14 PM, carlopmart wrote: > On 12/15/2010 07:38 PM, carlopmart wrote: > >> >> Thanks Dan. >> >> I have installed ossec as a server disabling rootchek, syscheck and active >> response. >> But when I launch ossec init script syscheckd is started. How can I >> prevent to star

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread dan (ddp)
On Wed, Dec 15, 2010 at 2:15 PM, carlopmart wrote: > On 12/15/2010 08:10 PM, dan (ddp) wrote: >> >> On Wed, Dec 15, 2010 at 1:38 PM, carlopmart  wrote: >>> >>> On 12/15/2010 07:14 PM, d.asse...@cgi.com wrote:  And the answer is E   But I did remove some functionality from the s

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 08:49 PM, Michael Starks wrote: On Wed, 15 Dec 2010 18:38:23 +0100, carlopmart wrote: Hi all, Somebody know if it is possible to do two different installations on the same host, one as an agent and another as a server?? Sure: http://www.immutablesecurity.com/index.php/2010/10/2

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 08:51 PM, dan (ddp) wrote: I think, in the syscheck section, you can add yes. I don't see it in the documentation, but I see references in the source to it (which I can't dig into very much). I kind of remember there being a similar optionf or rootcheck. I have tried it, and do

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread Michael Starks
On Wed, 15 Dec 2010 21:06:19 +0100, carlopmart wrote: On 12/15/2010 08:49 PM, Michael Starks wrote: On Wed, 15 Dec 2010 18:38:23 +0100, carlopmart wrote: Hi all, Somebody know if it is possible to do two different installations on the same host, one as an agent and another as a server??