[ossec-dev] [Bug 47] New: Analysis-server active response option not working

[ossec-bugzilla@xxxxxxxxxxxxxxxxxxxxxxxxxxx]

http://www.ossec.net/bugs/show_bug.cgi?id=47

           Summary: Analysis-server active response option not working
           Product: OSSEC
           Version: 1.2
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ossec core
        AssignedTo: ossec-dev@xxxxxxxxx
        ReportedBy: koco82@xxxxxxxxx


Ossec manual at section 7.1.2 (Responses configuration):
# - location: Where the command should be executed. You have four options:
    * local: on the agent that generated the event,
    * analysis-server: on the analysis server,
    * defined-agent: on a specific agent
    * all: or everywhere.

but analysis-server option is rejected if used: "(1302): Invalid active
response location:'analysis-server'". 

Taking a look at the code at active-response.c, I noticed that the <location>
field is compared to the string "AS|analysisd" at line 177; if this string is
introduced inside the <location> tag, the behaviour is the expected one, so
either the manual or source code should be fixed.


-- 
Configure bugmail: http://www.ossec.net/bugs/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.