agent.conf

Overview

More information on using the agent.conf can be found here

Supported types

The agent.conf is valid on the server install only.

Location

The agent.conf exists in /var/ossec/etc/shared. It should be readable by the ossec user.

-r-xr-x---  1 root  ossec  10908 Aug 12 16:06 /var/ossec/etc/shared/agent.conf

XML excerpt to show location:

<agent_config>
    ...
</agent_config>

Options

  • agent_config_options

  • agent_config

    Defines the beginning or end of an agent configuration block.

    • name

    This option to agent_config allows you to assign the block the one particular agent by using the agent’s name.

    Example: <agent_config name=”agent007”>

    • os

    This option to agent_config allows you to assign the block to an operating system.

    Example: <agent_config os=”Windows”>

    Allowed: Any OS family (Windows, Linux, OpenBSD, etc.)

    • profile

    This option to agent_config allows you to assign a profile name to the the block. Any agent may use this block if it is configured to use the defined profile.

    Example: <agent_config profile=”webservers”>