msauth_rules.xml is the same file as windows_rules. It ships with the
server installation , but windows events are not processing
-----Original Message-----
From: [email protected] [mailto:[EMAIL PROTECTED]
On Behalf Of [EMAIL PROTECTED]
Sent: Thursday, August 10, 2006 9:39 AM
To: [email protected]
Subject: [ossec-list] Re: racoon's ipsec log
I suppose you must add the following lines to the ossec.conf
<localfile>
<log_format>racoon</log_format>
<location>/var/log/racoon.log</location>
</localfile>
Ruurd Bakker
Network engineer
SECQuard.nl
