Hey,
It can parse the log without problems. This message is generated by this rule:
<rule id="1003" level="13" maxsize="1025">
<description>Non standard syslog message (size too large).</description>
</rule>
So, you can ignore that rule for this specific log you are parsing or
just increase
the size for everyone... Example:
<rule id="100103" level="0">
<description>Ignoring size to large alerts for myapp.</description>
<match>myapp log</match> OR you can use <program_name>myapp</program_name>
</rule>
Thanks,
--
Daniel B. Cid
dcid ( at ) ossec.net
On Fri, Dec 11, 2009 at 5:07 PM, jplee3 <[email protected]> wrote:
> Hey guys,
>
> Just wondering but with the "Non standard syslog message (size too
> large)" message, does this mean that OSSEC can't parse the log,
> period? Is there any way to increase the limit size so that it *can*
> read/parse larger messages? Also, does this only apply to syslog, or
> to other logs as well?
>
> The reason is because I'm trying to parse a custom log and it is
> pretty huge... would the only other option be to pre-parse the log
> first so that it's smaller and then have OSSEC look at the smaller log?
>
