up vote 0 down vote favorite
share [g+] share [fb]

I don't know why this isn't more plainly obvious on the website: http://www.ossec.net/

But I can't tell if I need to install a 'server' portion on Linux and then an 'agent' on Windows and then monitor through Linux, or if I can use Windows for the entire setup.

Any ideas how this should work for monitoring Windows servers?

link|improve this question
74% accept rate
feedback

2 Answers

up vote 1 down vote

Do I need at least 1 Linux server to use OSSEC to monitor my Windows servers?

Yes, you need a *nix server to install OSSEC Manager or try to compile it with Cygwin.

link|improve this answer
So to be clear I would then be logging into the *nix server to view the logs, though I would just install the agent on whatever server (nix or windows) that I want to monitor? – Ryan Aug 10 '11 at 18:43
If you mean the logs that do trigger alerts, then, the answer is exactly. They are stored in /var/ossec/logs/alerts. You also can integrate OSSEC with Splunk for quick search. Read more: ossec.net/doc/faq/ossec.html – quanta Aug 11 '11 at 2:26
feedback
up vote -1 down vote

You need a server that can be either Windows or Linux.

It's explained here,

http://www.ossec.net/doc/ http://www.ossec.net/main/wp-content/uploads/2009/02/ossec-arch.jpg http://www.ossec.net/ossec-docs/auscert-2007-dcid.pdf

link|improve this answer
1  
Please edit your "answer" to include a real answer, not just a pointer to a PDF. – ErikA Aug 9 '11 at 19:56
Ok so it says there is a local install and a server/agent install, but I still can't tell if it can reside entirely on Windows or not. – Ryan Aug 9 '11 at 19:56
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.