Hi, make sure that ownership and rights of the directory (and all files and folders under it) that you're symlinking to are :
drwxr-xr-x 6 ossec ossec 204 Aug 23 00:26 logs I just tried it and it works : drwxr-xr-x 4 ossec ossec 136 Dec 10 02:42 ossec lrwxr-xr-x 1 ossec ossec 11 Dec 10 02:41 logs -> /test/ossec KR, Wim On 09 Dec 2009, at 23:13, jplee3 wrote: > Actually, I just tried a symlink and OSSEC complained > > Starting OSSEC: 2009/12/09 14:04:09 ossec-syscheckd(1210): ERROR: > Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection > refused'. > 2009/12/09 14:04:09 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ > queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/09 14:04:17 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ > queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/09 14:04:17 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ > queue/ossec/queue' not accessible: 'Connection refused'. > > > So it seems I'll actually have to reinstall OSSEC in the specific > location where I would want the logs to go. The reason I wanted to > change the logging dir was because of space issues. > > I hope this can be an option in future releases!!! > > Guess my only other option, if I'm not allowed to install on the new > drive [dedicated to logs] they allocate, I can use logrotate or run a > nightly cronjob to move them over. > > On Dec 9, 12:22 pm, Jeremy Rossi <[email protected]> wrote: >> The process the outputs the logs is chrootedhttp://j.mp/4qzty4to the ossec >> path `/var/ossec` and does not have access to anything outside of this >> location. >> >> -Jeremy Rossi >> >> On Dec 9, 2009, at 2:47 PM, jplee3 wrote: >> >>> Hi all, >> >>> Is there a way to change the default OSSEC logging directory to store >>> logs elsewhere? I'm talking about /var/ossec/logs - is there an option >>> somewhere to change this to another directory? Or will I need to >>> symlink? >> >>> Thanks, >>> Jeremy
