Actually, I just tried a symlink and OSSEC complained Starting OSSEC: 2009/12/09 14:04:09 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2009/12/09 14:04:09 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ queue/ossec/queue' not accessible: 'Connection refused'. 2009/12/09 14:04:17 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ queue/ossec/queue' not accessible: 'Connection refused'. 2009/12/09 14:04:17 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ queue/ossec/queue' not accessible: 'Connection refused'.
So it seems I'll actually have to reinstall OSSEC in the specific location where I would want the logs to go. The reason I wanted to change the logging dir was because of space issues. I hope this can be an option in future releases!!! Guess my only other option, if I'm not allowed to install on the new drive [dedicated to logs] they allocate, I can use logrotate or run a nightly cronjob to move them over. On Dec 9, 12:22 pm, Jeremy Rossi <[email protected]> wrote: > The process the outputs the logs is chrootedhttp://j.mp/4qzty4to the ossec > path `/var/ossec` and does not have access to anything outside of this > location. > > -Jeremy Rossi > > On Dec 9, 2009, at 2:47 PM, jplee3 wrote: > > > Hi all, > > > Is there a way to change the default OSSEC logging directory to store > > logs elsewhere? I'm talking about /var/ossec/logs - is there an option > > somewhere to change this to another directory? Or will I need to > > symlink? > > > Thanks, > > Jeremy
