The ossec-agentd program is the client-side daemon that communicates with the server. It runs as ossec and is chrooted to /var/ossec.
+-----------------+-------------------------------------------------------------------------------------------------+ | -c <config> | Run using <config>, as the configuration file. | + +-------------------------------------------+-----------------------------------------------------+ | | Default value | /var/ossec/etc/ossec.conf | +-----------------+-------------------------------------------+-----------------------------------------------------+ | -D <dir> | Chroot to <dir> | + +-------------------------------------------+-----------------------------------------------------+ | | Default value | /var/ossec | +-----------------+-------------------------------------------+-----------------------------------------------------+ | -d | Run in debug mode. This option may be repeated to increase the verbosity of the debug messages. | +-----------------+-------------------------------------------------------------------------------------------------+ | -f | Run in the foreground. | +-----------------+-------------------------------------------------------------------------------------------------+ | -g <group> | Run as a group. | +-----------------+-------------------------------------------------------------------------------------------------+ | -h | Display the help message. | +-----------------+-------------------------------------------------------------------------------------------------+ | -t | Test configuration. | +-----------------+-------------------------------------------------------------------------------------------------+ | -u <user> | Run as a user. | + +-------------------------------------------+-----------------------------------------------------+ | | Default value | ossecm | +-----------------+-------------------------------------------+-----------------------------------------------------+ | -V | Display the version and license information | +-----------------+-------------------------------------------------------------------------------------------------+