On Thu, Aug 12, 2010 at 4:17 PM, Chad Hammond <[email protected]> wrote: > To whom it may concern: > > I want to disable or comment out the Window event logs I want to user > everything else. The reason for this is I have a solution for Event Logs I > really don’t need two of them right now. The second issue I am having is > that I am trying to get the WEBUI working which I have everything installed > according to the tutorial on your wiki site. When I try to go to the page > http://localhost/ossec-wui I end up getting a prompted for a file download > which is a phtml file. If you could give me a little assistance with these > two requests that would be greatly appreciated. > > Thanks in advance, > > Chad > >
With the WUI (I don't use it, and no one maintains it, so this is a guess): Is your webserver setup to deliver phtml files correctly? Possibly add something like: AddType text/html .phtml As far as the windows logs, you might be able to comment out the log lines from the config on the agents. Or maybe create an ignore rule, something like (also untested): <rule id="INSERT_VALID_ID" level="0"> <decoded_as>windows</decoded_as> <description>Ignore windows events.</description> </rule>
