Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I don't know why this isn't more plainly obvious on the website: http://www.ossec.net/

But I can't tell if I need to install a 'server' portion on Linux and then an 'agent' on Windows and then monitor through Linux, or if I can use Windows for the entire setup.

Any ideas how this should work for monitoring Windows servers?

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

Do I need at least 1 Linux server to use OSSEC to monitor my Windows servers?

Yes, you need a *nix server to install OSSEC Manager or try to compile it with Cygwin.

share|improve this answer
    
So to be clear I would then be logging into the *nix server to view the logs, though I would just install the agent on whatever server (nix or windows) that I want to monitor? –  ioSamurai Aug 10 '11 at 18:43
    
If you mean the logs that do trigger alerts, then, the answer is exactly. They are stored in /var/ossec/logs/alerts. You also can integrate OSSEC with Splunk for quick search. Read more: ossec.net/doc/faq/ossec.html –  quanta Aug 11 '11 at 2:26
add comment

You need a server that can be either Windows or Linux.

It's explained here,

http://www.ossec.net/doc/ http://www.ossec.net/main/wp-content/uploads/2009/02/ossec-arch.jpg http://www.ossec.net/ossec-docs/auscert-2007-dcid.pdf

share|improve this answer
1  
Please edit your "answer" to include a real answer, not just a pointer to a PDF. –  EEAA Aug 9 '11 at 19:56
    
Ok so it says there is a local install and a server/agent install, but I still can't tell if it can reside entirely on Windows or not. –  ioSamurai Aug 9 '11 at 19:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.