On Wed, Oct 28, 2009 at 11:06 AM, Holger Gläß <[email protected]> wrote: > hi > > that's it. > > but i diden't found howto setup seperate files for the remote servers. > > or write ossec all received messages in one logfile. > > > for examle i look an funktion like > > <localfile> > <srcip>remote ip</srcip> > <log_format>syslog</log_format> > <location>/var/log/auth.log</location> > </localfile> > > > > > > holger > >
If you're using the basic syslog method, the syslog server should determine where to put the log entries. Which syslog package are you running? Some are easier to configure than others.
