Hi Tim, Can you show us your syslog config and the output from /var/ossec/logs/ossec.log that has csyslog on it? You should be seeing something like:
# cat /var/ossec/logs/ossec.log |grep csyslog 2008/09/12 11:46:25 ossec-csyslogd: INFO: Started (pid: 8524). 2008/09/12 11:46:25 ossec-csyslogd: INFO: Forwarding alerts via syslog to: '192.168.2.32:514'. If you are not, it is because you didn't enable csyslog (to do so, type: /var/ossec/bin/ossec-control enable client-syslog). Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Fri, Sep 5, 2008 at 1:31 PM, Tim Meader <[EMAIL PROTECTED]> wrote: > > Hopefully someone can help with this. Our setup is that we're using a > single machine as both our ossec server, and our central log server. We > use Splunk to read in log files via NFS mounts, and were excited to see > that ossec now outputs into an easily parsable syslog format. However, > so far, we've been unable to get this to work. I've followed the > directions here: > > http://www.ossec.net/wiki/index.php/Know_How:SyslogOutut > > But after the restart, it doesn't appear that syslog-ng on the same box > is picking up and messages formatted the way the instructions describe. > I'm still seeing all other logging messages on the system, but nothing > with "ossec:" in the output. > > I've even tried creating a special entry for the output in syslog-ng, using: > > filter f_ossec_fw { match("ossec:"); }; > destination d_ossec_fw { > file("/log/ossec-syslog/ossec-$R_YEAR-$R_MONTH-$R_DAY.log" > owner("root") group("root") perm(0644) dir_perm(0750) create_dirs > (yes)); > }; > log { source(s_remote); filter(f_ossec_fw); destination(d_ossec_fw); }; > > But no new files are being created. It seems as if no messages at all > are being sent to our syslog-ng daemon. > > I've attempted to use the host's public IP as well as 127.0.0.1 for the > "<server>xxxx</server>" block as described in the wiki for syslog > output. Neither seems to have any affect. We are receiving plenty of > other logs via port 514 on the same box, so that's not an issue. > > Any ideas of further debugging to do/try in order to pin down what the > problem is? > > Thanks in advance. > -- > > Timothy Meader > L-3 Communications, NASA EOS Security Operations > [EMAIL PROTECTED] > (301) 614-6371 > >
