Hi, I've succesfully installed OSSEC in a different path than /var . Whatever you choose as your installdir, appended with /logs is your log dir. I'm sure you can symlink it, but haven't tried that yet. I'm not aware of a setting (either at compile time or in the config files afterwards) to specify a different location.
Cheers, Wim On 09 Dec 2009, at 21:22, Jeremy Rossi wrote: > The process the outputs the logs is chrooted http://j.mp/4qzty4 to the ossec > path `/var/ossec` and does not have access to anything outside of this > location. > > -Jeremy Rossi > > > On Dec 9, 2009, at 2:47 PM, jplee3 wrote: > >> Hi all, >> >> Is there a way to change the default OSSEC logging directory to store >> logs elsewhere? I'm talking about /var/ossec/logs - is there an option >> somewhere to change this to another directory? Or will I need to >> symlink? >> >> >> >> Thanks, >> Jeremy >
