topic Re: OSSEC Agent Management configuration in All Apps and Add-ons

OSSEC Agent Management configuration

dlynum — Wed, 12 Oct 2011 19:05:29 GMT

I'm new to OSSEC. I've got version 2.6 of OSSEC installed, running, and sending me alerts. Since I'm only monitoring one host with OSSEC, I did a local install. I'm running Splunk 4.2.3, and your Splunk for OSSEC plugin. When I went to the Agent Management page, and clicked on "List Agents", I received the message "This OSSEC Server is not configured for agent management."

How do I configure agent management?

Thanks

Re: OSSEC Agent Management configuration

ddpbsd — Thu, 13 Oct 2011 00:19:11 GMT

"Agents" in this context refers to OSSEC agents. OSSEC agents are systems running OSSEC and reporting log messages, file integrity checksums, and other information to a centralized OSSEC server.

A local OSSEC install will not have any agents.

Re: OSSEC Agent Management configuration

dlynum — Thu, 13 Oct 2011 23:37:34 GMT

Since I'm only monitoring a single server, would it make any sense for me to add an agent onto it so that I can use Splunk for OSSEC to its potential?

Re: OSSEC Agent Management configuration

ddpbsd — Thu, 13 Oct 2011 23:42:43 GMT

That's entirely up to you. If you don't want to monitor another system, adding it as an agent is probably not a good idea.

Re: OSSEC Agent Management configuration

southeringtonp — Fri, 14 Oct 2011 21:47:54 GMT

The agent screens in Splunk for OSSEC are really meant for dealing with OSSEC agent keys, which are used to identify individual remote OSSEC agents and protect data in transit.

As ddpbsd pointed out, these are really more applicable for multi-system installations. If you are only going to run a single system, the agent management screens will not be particularly useful.

That said, you configure agent management by creating/editing the file called ossec_servers.conf in your $SPLUNK_HOME/etc/apps/ossec/local directory.

Take a look at the README file included with Splunk for OSSEC for more detail, and if anything doesn't make sense feel free to ask. But essentially you need to provide a path for Splunk to execute OSSEC's manage_agents and agent_control commands.

Re: OSSEC Agent Management configuration

dlynum — Fri, 14 Oct 2011 22:24:38 GMT

Ok. Thanks ddpbsd. I think that part of my concern was, being new to this app, I didn't see any data when I went to the dashboard for it. But as of right now I'm seeing data. Thanks