Hi Gagan, I don't run AIX (or even have access to one), so it is a platform that is very hard for us to support, but I think the SULOG and AUTHLOG are good additions to be monitored by default.
Regarding "errpt", I believe you can send its output to syslog, which can easily be monitored by OSSEC: http://unix.derkeiler.com/Mailing-Lists/AIX-L/2003-04/0058.html Btw, can you provide us with samples of your SULOG, AUTHLOG and the changes you made to ossec.conf? If you can also show us samples of the errpt log to syslog, we will make sure to add support for it on the next version.... *with AIX and some other proprietary platforms, we need a lot of community help to make sure we support it well. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Thu, Mar 6, 2008 at 7:32 AM, <[EMAIL PROTECTED]> wrote: > > Dear Mailing List > > I am facing some problems while configuring the agent on AIX 5.3. > Prior to this I have done successful installations & they are working > beautifully on windows and linux servers. While agent installtion it > picks up the logs to be monitored and configure ossec.conf. > During the agent instalation on AIX platform No parameters were taken > by the install. > I had manually edited the ossec.conf file and put SULOG and AUTHLOG as > local file to be monitored (which are working fine). > Can any one tell which other logs or files we should monitor for > effectiveness on AIX box. > Does Ossec is equipped with any parser which can read from the files > normally not legible in syslog or normal log format. > Rather those files are read by using errpt command on AIX. > > In other words how can we read important error logs on AIX box. What > should be there configuration parameter in ossec.conf. > > Anyone who have implemented the same??? > > Thanks & Regards > Gagan Bhatia >
