Thanks dan.
i have configured those lines in ossec.conf on the server.
Questions
1. if ossec and syslog-ng are both running on the same server
(different ports) - will this work? read a post and it seems this is a
bad idea.
2. Also correct me if i'm wrong, if i do not specify the <level>
parameters under <syslog_output>, items that appear in /ossec/log/
alerts should be passed to the syslog server?
3. Do i need to change any settings under
<remote>
<connection>syslog</connection>
</remote>
<remote>
<connection>secure</connection>
</remote>
<alerts>
<log_alert_level>1</log_alert_level>
<email_alert_level>7</email_alert_level>
</alerts>
Thanks in advance.
On Aug 16, 9:14 pm, "dan (ddp)" <[email protected]> wrote:
> On Mon, Aug 16, 2010 at 6:44 AM, GeorgeY <[email protected]> wrote:
> > Hi all,
>
> > Please forgive me if this has been asked before. I researched and
> > found a lot related to syslog but nothing really gave me a clear
> > picture.
>
> > I noticed Windows event viewer events being logged in /ossec/logs/
> > alerts. I know these events are generated if any events match those
> > listed under /ossec/rules.
>
> > Question - If i wanted to log these events to a central syslog server
> > running syslog-ng, do I configure this on the ossec server or the
> > ossec client? I read the manual page and I believe something like the
> > code below is needed on the client but is this code only required if
> > you are using ossec's own built in syslog engine?
>
> > <syslog_output>
> > <server>xx.xx.xx.xx</server>
> > </syslog_output>
>
> > and then
>
> > # /var/ossec/bin/ossec-control enable client-syslog
> > # /var/ossec/bin/ossec-control start
>
> > fromhttp://www.ossec.net/main/manual/manual-sending-alerts-via-syslog/
>
> > Thanks in advance
>
> The syslog output is a server side configuration.
