On Tue, Aug 31, 2010 at 8:43 AM, Aeterna <[email protected]> wrote: > Sure I can email a daily report, no problem manually. However the > reports don't mention the actual events even when there's only a few. > So what when I want to look at the actual events from the previous > day? When I look at my /logs/archives/year/month/ directory I see > this: > > nagios:~# ls -lah /var/ossec/logs/archives/2010/Aug/ > total 32K > drwxr-x--- 2 ossec ossec 4.0K 2010-08-31 00:03 . > drwxr-x--- 3 ossec ossec 4.0K 2010-08-25 17:06 .. > -rwxr-x--- 1 ossec ossec 282 2010-08-26 00:02 ossec- > archive-25.log.sum > -rwxr-x--- 1 ossec ossec 346 2010-08-27 00:00 ossec- > archive-26.log.sum > -rwxr-x--- 1 ossec ossec 346 2010-08-28 00:01 ossec- > archive-27.log.sum > -rwxr-x--- 1 ossec ossec 346 2010-08-29 00:00 ossec- > archive-28.log.sum > -rwxr-x--- 1 ossec ossec 346 2010-08-30 00:01 ossec- > archive-29.log.sum > -rw-r----- 1 ossec ossec 346 2010-08-31 00:03 ossec- > archive-30.log.sum > -rw-r----- 2 ossec ossec 0 2010-08-31 00:00 ossec-archive-31.log > > However I am confused about this since if I run: > zcat /var/ossec/logs/alerts/2010/Aug/*.gz | /var/ossec/bin/ossec- > reportd > > I'll get a full report full with the archived messages. So clearly you > can't view them as root but how can I best view the events from the > manager then? > >
I think the automated reports are supposed to be just a summary, not the full report. If you need the full report, running it manually seems to be the way to go.
