The process the outputs the logs is chrooted http://j.mp/4qzty4 to the ossec path `/var/ossec` and does not have access to anything outside of this location.
-Jeremy Rossi On Dec 9, 2009, at 2:47 PM, jplee3 wrote: > Hi all, > > Is there a way to change the default OSSEC logging directory to store > logs elsewhere? I'm talking about /var/ossec/logs - is there an option > somewhere to change this to another directory? Or will I need to > symlink? > > > > Thanks, > Jeremy
