Found it on the wiki. This option must go inside the global parameters. thanks
On Sat, Oct 23, 2010 at 1:03 PM, Net_Runner <[email protected]>wrote: > Hi, first of all, thanks for OSSEC great tool. > > I have a question about picviz support, i just added this to required lines > at the end of ossec.conf > > <picviz_output>yes</picviz_output> > <picviz_socket>/var/ossec/picviz.socket</picviz_socket> > > but when I restart the service its return me this: > > OSSEC HIDS v2.5.1 Stopped > Starting OSSEC HIDS v2.5.1 (by Trend Micro Inc.)... > 2010/10/21 19:21:45 ossec-config(1230): ERROR: Invalid element in the > configuration: 'picviz_output'. > 2010/10/21 19:21:45 ossec-config(1202): ERROR: Configuration error at > '/var/ossec/etc/ossec.conf'. Exiting. > 2010/10/21 19:21:45 ossec-testrule(1202): ERROR: Configuration error at > '/var/ossec/etc/ossec.conf'. Exiting. > ossec-analysisd: Configuration error. Exiting. > 2010/10/21 19:21:45 ossec-config(1230): ERROR: Invalid element in the > configuration: 'picviz_output'. > 2010/10/21 19:21:45 ossec-config(1202): ERROR: Configuration error at > '/var/ossec/etc/ossec.conf'. Exiting. > 2010/10/21 19:21:45 ossec-maild(1202): ERROR: Configuration error at > '/var/ossec/etc/ossec.conf'. Exiting. > debian:/var/ossec/etc# > > > As you can see, my ossec version is 2.5.1 > thanks you in advance > >
