2 - You have these installation options: server, agent, local, or hybrid.
4 - If you choose 'server', you will be able to analyze all
5 the logs, create e-mail notifications and responses,
6 and also receive logs from remote syslog machines and
7 from systems running the 'agents' (from where traffic
8 is sent encrypted to the server).
10 - If you choose 'agent'(client), you will be able to read
11 local files (from syslog, snort, apache, etc) and forward
12 them (encrypted) to the server for analysis.
14 - If you choose 'local', you will be able to do everything
15 the server does, except receiving remote messages from
16 the agents or external syslog devices.
18 - If you choose 'hybrid', you get the 'local' installation
19 plus the 'agent' installation.
21 - Choose 'server' if you are setting up a log/analysis server.
23 - Choose 'agent' if you have another machine to run as a log
24 server and want to forward the logs to the server for analysis.
25 (ideal for webservers, database servers ,etc)
27 - Choose 'local' if you only have one system to monitor.
29 - Choose 'hybrid' if you want this standalone system to analyze
30 local logs before forwarding alerts to another server.
32 - More information at:
33 http://www.ossec.net/en/manual.html#starting