How did you enable debugging? Try adding -d to the command
('/var/ossec/bin/ossec-logcollector -d' or whatever).But it should continue running, and hopefully pick up all logfiles along the way. On Tue, Sep 28, 2010 at 2:07 PM, Jason 'XenoPhage' Frisvold <[email protected]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi all, > > I just installed v2.5 on a server and fired it up. Beyond the upgraded > rules 2.5 brings, I'm using the same configuration from 2.4.1. In > 2.4.1, I used globs for localfile definitions such as this : > > <localfile> > <log_format>apache</log_format> > <location>/var/www/*/logs/*access_log</location> > </localfile> > > The basic goal here is to grab all of the log files from the given > server without having to specify them one at a time.. It's one thing to > do this once, but when you have a number of servers configured the same > way, but with different directory names, things can become unmanageable > pretty quickly. > > At any rate, this worked on 2.4.1 with no problems. With 2.5, > logcollector starts, gets through the first 3 directories in the glob, > and then .. and then logcollector is no longer running. No errors, no > warning. It just stops. I tried turning on debugging, but this doesn't > seem to produce any additional usable information. > > So is this considered a bug, or is this expected behavior? > > Thanks, > > - -- > - --------------------------- > Jason 'XenoPhage' Frisvold > [email protected] > - --------------------------- > "Any sufficiently advanced magic is indistinguishable from technology." > - - Niven's Inverse of Clarke's Third Law > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.14 (GNU/Linux) > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ > > iEYEARECAAYFAkyiLusACgkQ8CjzPZyTUTQZ0QCfaNbjkK34EWkMFLZleJvQW/as > gCcAn2UkS8udqSxUNpWYxyn4QUWg16Pu > =b27/ > -----END PGP SIGNATURE----- >
