Hi Ossec'ers; I need some help please. I would like the ossec server to log all alerts and messages to local syslog NOT to a remote syslog. I have rsyslog installed in the localhost, what changes do I make to /etc/ rsyslog.conf and what changes do I make to /etc/ossec.conf?
I have seen instruction for sending syslog to remote syslog host, but I do not want to do that, I want to record ossec logs to local syslog - say in /var/log/messages or /var/log/secure. How can I do this... Any help will be greatly appreciated. Thx Ali.
