The ossec-logtest application gives better errors. After inserting an error in my local_rules file and running ossec-logtest I get the following:
# ../bin/ossec-logtest 2009/12/16 13:42:58 ossec-analysisd(1226): ERROR: Error reading XML file 'rules//local_rules.xml': XML ERR: Element not closed: rule_id="110143" (line 1655). 2009/12/16 13:42:58 ossec-testrule(1220): ERROR: Error loading the rules: 'local_rules.xml'. Not perfect, but might be useful. Dan On Wed, Dec 16, 2009 at 7:21 AM, Pachulski, Keith <[email protected]> wrote: > Yea, after doing some digging I found a reference to this from an ossec-dev > page. Turned out while I was editing the local-rules file via vi, I hit I to > insert and there was an extra I in the file. It would be awesome if the > errors were a bit more useful such as "hey moron you have an error in file X > on line 23, check it because I`m not doing jack till you fix it"; other than > " ERROR: Queue '/queue/ossec/queue' not accessible: 'Connection refused'." =) > > Thanks everyone for the responses... >
