.. _installation_types:

==================
Installation Types
==================

OSSEC can be installed in an agent/server combination or as a stand-alone system.
The stand-alone installation is essentially a server installation without the pieces that interact with agents.
The server installation includes the agent functionality for the local system.


Server
^^^^^^

In an OSSEC server/agent installation, the agents pass log messages to the server for processing.
Rules and decoders are installed only on the server.
Alerts are generated and distributed from the server.

Agent
^^^^^

OSSEC agents tail the local log files and forward the messages to the OSSEC server.
Local file integrity monitoring messages are also forwarded to the server.

Hybrid
^^^^^^

A hybrid installation is both a server and agent.
As a server it processes logs for a number of agents, and as an agent it forwards alerts to another server.

Local
^^^^^

A local, or stand-alone, installation resides entirely on a singular system.
It is not associated with a server or agents.
Decoders and rules will be stored on a local installation.