[ossec-list] Re: How are rules enacted?

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi John,

Rick explained it well, just edit your rules at local_rules.xml and
restart the server when
done. Nothing needs to be restarted at the agent side. As for writing
your own rules,
the following document can be very helpful:

http://www.ossec.net/ossec-docs/auscert-2007-dcid.pdf


Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 10/12/07, John Hinton <johnhinton@xxxxxxxxxxxxxx> wrote:
>
> I have set up a server/agents system. These are on CentOS systems so it
> would be equivalent to RedHat EL servers.
>
> I'm wondering what needs to be done upon the edit of a rule.
>
> Does the server need to be restarted? Do each of the agents need to be
> restarted? Does the server and all of the agents need to be restarted?
> Or, does the rule go into effect at the time of the edit or maybe
> something is set to reread the rules at some time afterwards?
>
> Yes, I'm experimenting with rules and am trying to figure out if I have
> an 'order' situation, where one rule steps in before my new rule is
> enacted.... which will likely be the topic of my next post after knowing
> the answer to this.
>
> Thanks for a great program!
>
> Best,
> John Hinton
>