On 06/10/2010 07:41 AM, Ali wrote:
Hi Ossec'ers;
I need some help please. I would like the ossec server to log all
alerts and messages to local syslog NOT to a remote syslog. I have
rsyslog installed in the localhost, what changes do I make to /etc/
rsyslog.conf and what changes do I make to /etc/ossec.conf?
I have seen instruction for sending syslog to remote syslog host, but
I do not want to do that, I want to record ossec logs to local syslog
- say in /var/log/messages or /var/log/secure. How can I do this...
Any help will be greatly appreciated.
I'm doing this with syslog-ng. In addition, I also reformat the OSSEC
formatted logs to proper syslog and store them in directories based on
hostname/log-name. Not sure if syslog-ng filters are compatible with
rsyslog...
--
Michael Starks
[I] Immutable Security
http://www.immutablesecurity.com
