Hi,
Good day.
I came across a couple threads mentioning it's impossible to have OSSEC point to another logging directory due to "chrooted processes" - this seems a bit convoluted and I just wanted to know practically *why* it isn't possible and if there are any thoughts on bringing the option in (and if not, why not).
once a process chroots it is no longer able to see anything outside of that chroot path.
Almost all ossec process chroot to /var/ossec so anything not under that path are completely unavailable to them. And this is the reason logs MUST be located under /var/ossec.
I don't see any reason why it would be a bad idea to be able to log to another location. I know the OSSEC logs don't grow very large, but this dynamic can change if many clients are added that are generally noisier (depending on how the alerting is setup). Regardless, it would just be nice to have the option.
At this time I don't see this option coming to ossec as it would require a large number of changes and a new daemon just for writing logs to disk (not really a bad idea, just a fair amount of code). Removing the chroot at start up for daemons will also not happen as this is a one of the part used to making sure ossec does not become a security risk to the system as a whole.
I know there are several workarounds: mounting a new partition and assigning it /var/ossec/logs, but that can be quite a hassle depending on the environment and won't work for everyone. The only other option is rsyncing files over, but that's more overhead to be concerned about.
Given your worries about size of log files might a suggest you install ossec into a different location?
-Jeremy Rossi e: [email protected]
