On Wed, Aug 18, 2010 at 4:24 AM, GeorgeY <[email protected]> wrote: > Thanks dan. > i have configured those lines in ossec.conf on the server. > Questions > 1. if ossec and syslog-ng are both running on the same server > (different ports) - will this work? read a post and it seems this is a > bad idea.
I'm not using syslog-ng, but I haven't noticed any problems running a syslog server and ossec server on the same box. > 2. Also correct me if i'm wrong, if i do not specify the <level> > parameters under <syslog_output>, items that appear in /ossec/log/ > alerts should be passed to the syslog server? I think so, but I haven't set this up in a while. > 3. Do i need to change any settings under > > <remote> > <connection>syslog</connection> > </remote> > > <remote> > <connection>secure</connection> > </remote> > > <alerts> > <log_alert_level>1</log_alert_level> > <email_alert_level>7</email_alert_level> > </alerts> > > Thanks in advance. > You probably don't need both the syslog and secure connection options.
