Hopefully someone can help with this. Our setup is that we're using a single machine as both our ossec server, and our central log server. We use Splunk to read in log files via NFS mounts, and were excited to see that ossec now outputs into an easily parsable syslog format. However, so far, we've been unable to get this to work. I've followed the directions here:
http://www.ossec.net/wiki/index.php/Know_How:SyslogOutut But after the restart, it doesn't appear that syslog-ng on the same box is picking up and messages formatted the way the instructions describe. I'm still seeing all other logging messages on the system, but nothing with "ossec:" in the output. I've even tried creating a special entry for the output in syslog-ng, using: filter f_ossec_fw { match("ossec:"); }; destination d_ossec_fw { file("/log/ossec-syslog/ossec-$R_YEAR-$R_MONTH-$R_DAY.log" owner("root") group("root") perm(0644) dir_perm(0750) create_dirs (yes)); }; log { source(s_remote); filter(f_ossec_fw); destination(d_ossec_fw); }; But no new files are being created. It seems as if no messages at all are being sent to our syslog-ng daemon. I've attempted to use the host's public IP as well as 127.0.0.1 for the "<server>xxxx</server>" block as described in the wiki for syslog output. Neither seems to have any affect. We are receiving plenty of other logs via port 514 on the same box, so that's not an issue. Any ideas of further debugging to do/try in order to pin down what the problem is? Thanks in advance. -- Timothy Meader L-3 Communications, NASA EOS Security Operations [EMAIL PROTECTED] (301) 614-6371
