Thanks for the note Michael, that's what I figured. In our case the integrity alerts are application specific which OSSEC handles perfectly. All our syslog messages are sent to a centralized log host and sometimes we see double logs based on what the ossec.conf is monitoring and syslog is pointing to...a little remediation will clean things up nicely.
On Jun 11, 10:25 pm, Michael Starks <[email protected]> wrote: > On 06/10/2010 09:31 AM, Maahkus wrote: > > > I want to use OSSEC for File Integrity only...I do not want to see any > > <syslog> messages from var/adm/messages etc...is the best way to not > > see these just to comment out the entry in the OSSEC.conf file? I do > > not want to have change any lines in the syslog.conf files... > > Yes, if you simply comment out the logs that OSSEC normally monitors, > you won't get alerts. You may also need to make some further > modifications so you don't get rootcheck alerts, if that is your goal. > > I can't help but wonder, why not get alerts from log files? I find them > much more useful than integrity alerts. > > -- > Michael Starks > [I] Immutable Securityhttp://www.immutablesecurity.com
