I have not tested symlinks myself they should work buy only in one direction due to the chroot environment.
Example: # cd ossec-hids-2.3 # ./install.sh [...SNIP INSTALL DETAILS..] # ln -s /var/ossec/logs /var/log/ossec This will allow access to the logs via the path /var/log/ossec/. I have just tested this on my ossec test vmware image and works as expected: # (cd /var/log && ls -la ossec) lrwxr-xr-x 1 root wheel 21 Dec 10 02:53 ossec -> /var/ossec/logs # (cd /var/log/ossec && ls -la) total 19828 drwxr-x--- 5 ossec ossec 512 Oct 28 12:47 . dr-xr-x--- 13 root ossec 512 Nov 6 15:03 .. drwxr-x--- 3 ossec ossec 512 Dec 10 02:54 alerts drwxr-x--- 3 ossec ossec 512 Dec 10 02:54 archives drwxr-x--- 3 ossec ossec 512 Dec 10 02:54 firewall -rw-rw-r-- 1 ossec ossec 10122698 Dec 10 02:56 ossec.log If you preform the symlink in the other direction it will fail as ossec cannot access anything outside of /var/ossec or whatever you supplied during the install. -Jeremy Rossi On Dec 9, 2009, at 5:13 PM, jplee3 wrote: > Actually, I just tried a symlink and OSSEC complained > > Starting OSSEC: 2009/12/09 14:04:09 ossec-syscheckd(1210): ERROR: > Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection > refused'. > 2009/12/09 14:04:09 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ > queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/09 14:04:17 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ > queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/09 14:04:17 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ > queue/ossec/queue' not accessible: 'Connection refused'. > > > So it seems I'll actually have to reinstall OSSEC in the specific > location where I would want the logs to go. The reason I wanted to > change the logging dir was because of space issues. > > I hope this can be an option in future releases!!! > > Guess my only other option, if I'm not allowed to install on the new > drive [dedicated to logs] they allocate, I can use logrotate or run a > nightly cronjob to move them over. > > On Dec 9, 12:22 pm, Jeremy Rossi <[email protected]> wrote: >> The process the outputs the logs is chrootedhttp://j.mp/4qzty4to the ossec >> path `/var/ossec` and does not have access to anything outside of this >> location. >> >> -Jeremy Rossi >> >> On Dec 9, 2009, at 2:47 PM, jplee3 wrote: >> >>> Hi all, >> >>> Is there a way to change the default OSSEC logging directory to store >>> logs elsewhere? I'm talking about /var/ossec/logs - is there an option >>> somewhere to change this to another directory? Or will I need to >>> symlink? >> >>> Thanks, >>> Jeremy
