Re: [ossec-list] New install: Windows agent.conf doesn't get auto created

[dan (ddp)]

On Thu, Mar 29, 2018, 4:32 PM Neeraj Shah <neeraj...@gmail.com> wrote:

Hello All,

Need some help. I am trying out ossec with Security Onion.  The ossec server comes preinstalled in Security Onion. I am now trying the agent piece. I installed the v2.9.2 latest version agent on one of my Windows client pc's, did the initial config and restarted the agent.  From the ossec server, the agent ID shows connected. So far so good.

I then created the "/var/ossec/etc/shared/default/agent.conf"  on the server, put in a stanza for "os=windows" , saved the file and restarted the ossec server. After waiting for a while, I checked the client PC & the agent.conf didn't get created / deployed to the client. Infact, the agent logs on client were showing this error message" XML Error /shared/agent.conf not found" 

So i then went ahead and created the agent.conf manually on my client and restarted the service again.  The above XML error didn't show up this time but even after waiting for 15 mins or so, the agent.conf is empty. It is not downloading / syncing the changes from the agent.conf that's on the ossec server.

what could the reason be ? Any help appreciated 

Check permissions on the agent side? Look for the agent.conf contents in merged.mg?

--

---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.