Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
2.2 OSSIM Agent Configuration
2.2.1 Configuration File
/etc/ossim/agent/config.cfg
2.2.2 Parameters
[daemon]
daemon:
pid:
[event-consolidation]
[log]
Daemon mode (True or False)
Path to the PID file (Process identifier)
Enables event consolidation at agent level. It is recommended to use polices instead of this
feature as consolidation at the agent level affects the correlation process.
by_plugin:
enable:
time:
Example:
[event-consolidation]
List of plugins that will be consolidated
Enable or disable (True or False)
Wait n seconds to consolidate the events before sending them
by_plugin=1001-1150,1501-1550,4001-4010
enable=False
time=10
Configures the verbose level and the path to the different log files
error:
file:
stats:
[output-plain]
verbose:
File in which the error events will be stored
File in which all the agent logs will be stored
File in which the agent stats will be stored (Every 5 minutes)
Configures the verbose level (Debug, Info, Warning, Error or
Critical)
Writes in a log file what is being sent to the OSSIM Server (Useful for debugging and
developing purposes)
enable:
file:
[output-server]
Enable or disable (True or False)
File in which the output-plain will be stored
Configures the server to which events are sent
enable:
ip:
port:
Enable or disable sending events to the server (True or False)
IP address of the OSSIM Server
Listening port of the OSSIM Server
Page 11 Copyright © Alienvault 2010