Change remote settings

[Lucas]

Hello everyone
I want to remotely change the ossec.conf settings from wazuh manager to wazuh agent.

I added wazuh_command.remote_commands=1 to /var/ossec/etc/local_internal_options.conf of Wazuh Agent.

After that, I restarted the Wazuh Agent daemon.

I also changed some comments in the /var/ossec/etc/ossec.conf file on the Wazuh Master node, and changed the time setting of rootcheck, but the ossec.conf of Wazuh Agent remained unchanged.

What could be the problem? Please help me

[Manuel Jose Cano Rojo]

Hello Lucas,

I think you are confusing the files, let me lead you. The file that manages the agents' remote settings is agent.conf. Here is where you have to make the changes in order to provide the agents with the central configuration you want to distribute.

The centralized configuration is based on groups, so you should check this documentation in order to fully understand the grouping of agents. By default, all the agents belong to the "default" group. Worth mentioning, is the "wazuh_command.remote_commands=1" can not be changed remotely so if you want to enable it in more agents, you have to do it in every agent.

This documentation widely explains the step by step of using the centralized configuration, from the configuration options to its verification and deployment. If you find any problem, feel free to ask anything!

Regards,
Manuel.