dan (ddp) wrote: > On Wed, Oct 28, 2009 at 11:06 AM, Holger Gläß <[email protected]> wrote: > >> hi >> >> that's it. >> >> but i diden't found howto setup seperate files for the remote servers. >> >> or write ossec all received messages in one logfile. >> >> >> for examle i look an funktion like >> >> <localfile> >> <srcip>remote ip</srcip> >> <log_format>syslog</log_format> >> <location>/var/log/auth.log</location> >> </localfile> >> >> >> >> >> >> holger >> >> >> > > If you're using the basic syslog method, the syslog server should determine > where to put the log entries. Which syslog package are you running? Some > are easier to configure than others. > hi
i run syslog-ng as main syslog server and i hope that i can migrate this one to ossec. holger
