On Mon, Aug 16, 2010 at 6:44 AM, GeorgeY <[email protected]> wrote: > Hi all, > > Please forgive me if this has been asked before. I researched and > found a lot related to syslog but nothing really gave me a clear > picture. > > I noticed Windows event viewer events being logged in /ossec/logs/ > alerts. I know these events are generated if any events match those > listed under /ossec/rules. > > Question - If i wanted to log these events to a central syslog server > running syslog-ng, do I configure this on the ossec server or the > ossec client? I read the manual page and I believe something like the > code below is needed on the client but is this code only required if > you are using ossec's own built in syslog engine? > > <syslog_output> > <server>xx.xx.xx.xx</server> > </syslog_output> > > and then > > # /var/ossec/bin/ossec-control enable client-syslog > # /var/ossec/bin/ossec-control start > > from http://www.ossec.net/main/manual/manual-sending-alerts-via-syslog/ > > Thanks in advance > >
The syslog output is a server side configuration.
