jplee3 wrote: > So it seems I'll actually have to reinstall OSSEC in the specific > location where I would want the logs to go. The reason I wanted to > change the logging dir was because of space issues.
A minor point of clarification: there's a big difference in size between logs and alerts. I have used OSSEC on servers with lots of space for a log volume, but comparatively little space for OSSEC, where the alerts log is. In fact, I always isolate OSSEC onto its own partition so I can keep it from taking down the system if some process runs away and fills ossec.log. OSSEC doesn't need to be installed on the log volume, but due to the chrooting (as Jeremy said), there are certain (in my opinion, correct) limitations.
