On Tue, Oct 5, 2010 at 2:58 PM, Christopher Moraes <[email protected]> wrote: > Hi, > We're using syslog-ng to centralize logs on a server. The way the system > is setup is that *all* system logs (for unix, windows, apache, iis, etc) get > written to a single file on the syslog server. > Can OSSEC be configured to analyse this type of combined syslog file? > Regards, > Chris > > >
If the messages are in the same format (I'm guessing they will be since syslog-ng is accepting all messages), then it should handle this just fine. If they're in different formats you may have issues (apache vs. syslog formats).
