Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know why this isn't more plainly obvious on the website:

But I can't tell if I need to install a 'server' portion on Linux and then an 'agent' on Windows and then monitor through Linux, or if I can use Windows for the entire setup.

Any ideas how this should work for monitoring Windows servers?

share|improve this question
up vote 2 down vote accepted

Do I need at least 1 Linux server to use OSSEC to monitor my Windows servers?

Yes, you need a *nix server to install OSSEC Manager or try to compile it with Cygwin.

share|improve this answer
So to be clear I would then be logging into the *nix server to view the logs, though I would just install the agent on whatever server (nix or windows) that I want to monitor? – ioSamurai Aug 10 '11 at 18:43
If you mean the logs that do trigger alerts, then, the answer is exactly. They are stored in /var/ossec/logs/alerts. You also can integrate OSSEC with Splunk for quick search. Read more: – quanta Aug 11 '11 at 2:26

You need a server that can be either Windows or Linux.

It's explained here,

share|improve this answer
Please edit your "answer" to include a real answer, not just a pointer to a PDF. – EEAA Aug 9 '11 at 19:56
Ok so it says there is a local install and a server/agent install, but I still can't tell if it can reside entirely on Windows or not. – ioSamurai Aug 9 '11 at 19:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.