Hi all, Please forgive me if this has been asked before. I researched and found a lot related to syslog but nothing really gave me a clear picture.
I noticed Windows event viewer events being logged in /ossec/logs/ alerts. I know these events are generated if any events match those listed under /ossec/rules. Question - If i wanted to log these events to a central syslog server running syslog-ng, do I configure this on the ossec server or the ossec client? I read the manual page and I believe something like the code below is needed on the client but is this code only required if you are using ossec's own built in syslog engine? <syslog_output> <server>xx.xx.xx.xx</server> </syslog_output> and then # /var/ossec/bin/ossec-control enable client-syslog # /var/ossec/bin/ossec-control start from http://www.ossec.net/main/manual/manual-sending-alerts-via-syslog/ Thanks in advance
