Dear list, I have in my ossec.conf a segment that looks like this:
,-------- | <localfile> | <log_format>apache</log_format> | <location>/vz/private/2040/var/log/nginx/*/*.log</location> | </localfile> `-------- the problem I have is that if there is no such path, then ossec refuses to start: ,-------- | Starting OSSEC HIDS v1.5.1 (by Third Brigade, Inc.)... | 2008/08/28 09:57:32 ossec-logcollector(1121): ERROR: Glob error. Invalid pattern: '/vz/private/2040/var/log/nginx/*/*.log'. | 2008/08/28 09:57:32 ossec-logcollector(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting. | 2008/08/28 09:57:32 ossec-logcollector(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting. | ossec-logcollector: Configuration error. Exiting `-------- One might ask why not delete that segment at all. Yes it would be a fast solution. However I am running several ossec installations, and I would like to have a single config file (+ local_rules.xml) for all of them. It makes ossec maintain much easier. The problem is that not all machines have the same log files that should be monitored. If someone can give me a hint how to turn this error to eg a warning only, I am willing to try it. I am familiar with programming in C. thanks, Thanh
