Combining centralized and local agent.conf files

[notif...@gmail.com]

Hi!

Is it a good idea to use shared agent.conf and local agent.confs?

I have puppet managing an agent.conf file for all my client machines before I discovered 

using the shared agent.conf.

Can they be used together, and if so, how?

[dan (ddp)]

Isn't ossec.conf basically the local agent.conf?

>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[notif...@gmail.com]

I suppose you are correct, but I have both ossec.conf and shared/agent.conf on

each serve, and they both have different configuration (the agent.conf has 

<agent_config> values inside of it?

Which one of them does ossec depend on?

I must note that I installed these from the atomic repo onto RHEL and CentOS

machines.

I am grateful for any illumination.

[dan (ddp)]

On Wed, Aug 26, 2015 at 9:20 AM, <notif...@gmail.com> wrote:
> I suppose you are correct, but I have both ossec.conf and shared/agent.conf
> on
> each serve, and they both have different configuration (the agent.conf has
> <agent_config> values inside of it?
> Which one of them does ossec depend on?

ossec.conf is required, agent.conf is optional. Both configurations are used.

[notif...@gmail.com]

Problem is, I have some agent_configs that I moved from the general (puppet-managed) ossec.conf file,

into the shared agent.conf file.

When the configs were in the ossrc.conf file, they used to generate a lot of email (monitoring errors that

appear in log files mostly).

Now that they are in the agent.conf file, there is no more activity.

How can I force (or make) ossec-hids read the agent.conf file?

[dan (ddp)]

On Thu, Aug 27, 2015 at 5:14 PM, <notif...@gmail.com> wrote:
> Problem is, I have some agent_configs that I moved from the general
> (puppet-managed) ossec.conf file,
> into the shared agent.conf file.
> When the configs were in the ossrc.conf file, they used to generate a lot of
> email (monitoring errors that
> appear in log files mostly).
> Now that they are in the agent.conf file, there is no more activity.
> How can I force (or make) ossec-hids read the agent.conf file?
>

If the file exists, and is readable, it should be used. Of course,
that assumes there is a block inside it that applies to that agent.

[Sina Owolabi]

Yes, there are blocks that apply to the agents I have created specific
configurations for, and I sectioned them off with the full name of the
agent(s).
Please, are these agent.conf sections in order? I just added it to
what already exists in the file:

<agent_config name="wubly.corpdomain.lala">
<!-- wubly logs -->
<localfile>
<location>/opt/wubly/src/wubly/logs/*/*.log</location>
<log_format>syslog</log_format>
</localfile>
<directories realtime="yes"
check_all="yes">/root,/etc/httpd,/usr/share/tomcat6,/usr/share/tomcat7,/var/log/
httpd,/opt/wubly/ve/src/wubly/configFiles</directories>
</agent_config>

<agent_config name="canny2.corpdomain.lala">
<!-- wubly logs -->
<localfile>
<location>/opt/wubly/wubly/logs/*/*.log</location>
<log_format>syslog</log_format>
</localfile>
<directories realtime="yes"
check_all="yes">/root,/etc/httpd,/usr/share/tomcat6,/usr/share/tomcat7,/var/log/
httpd,/opt/wubly/wubly/configFiles</directories>
</agent_config>

<agent_config name="testor.testing.corpdomain.lala">
<localfile>
<log_format>apache</log_format>
<location>/var/log/stratus-ussd-customer/stratus.log</location>
</localfile>
</agent_config>

[dan (ddp)]

On Tue, Sep 1, 2015 at 10:50 PM, Sina Owolabi <notif...@gmail.com> wrote:
> Yes, there are blocks that apply to the agents I have created specific
> configurations for, and I sectioned them off with the full name of the
> agent(s).

These are the agent names, and not hostnames, correct?

> Please, are these agent.conf sections in order? I just added it to
> what already exists in the file:
>

I don't believe they need to be in any specific order.

> <agent_config name="wubly.corpdomain.lala">
> <!-- wubly logs -->
> <localfile>
> <location>/opt/wubly/src/wubly/logs/*/*.log</location>

I believe, in the ossec.log file, you should see entries about OSSEC
monitoring these log files. Do you see them? If not, try adding a
specific logfile instead of using the glob and check again for that
specific log file.

[Sina Owolabi]

Yes. The agents names are also their hostnames.

Sent using CloudMagic

[dan (ddp)]

On Sep 2, 2015 8:18 AM, "Sina Owolabi" <notif...@gmail.com> wrote:
>
> Yes. The agents names are also their hostnames.
>

Besides the other thing I listed, check to make sure the agents are getting the agent.conf and that the ossec processes are restarted when they do.

[Sina Owolabi]

Yes, the agents are getting the agent.conf file from the master. I restarted one of the agents in interested in but its logs do not reference the values on the agent.conf

I noticed the  agents have three conf files: the ossec.conf which I push with puppet,the agent.conf file inside /var/ossec/etc/shared directory, and an ossec-agent.conf file which is an exact duplicate of the ossec.conf file, and it's found in  the same / var/ossec/etc directory.
Is this supposed to be this way?

---

From: dan (ddp)
Sent: ‎9/‎2/‎2015 1:25 PM
To: ossec...@googlegroups.com
Subject: Re: [ossec-list] Combining centralized and local agent.conf files