for the syslog issue, you can configure syslog.conf in such a way that the incoming events from other servers are stored in a seperate log file and not your default /var/log/messages. http://www.aboutdebian.com/syslog.htm
If I rememeber correctly, the log collector daemon is the only daemon running with root privs just because of that reason. The daemon has no other purpose (or functionality) than reading messages and forwarding them to agentd. Cheers, Wim On Fri, Oct 29, 2010 at 1:26 AM, Hac Phan <[email protected]> wrote: > Hi, > > I want to have OSSEC on my syslog server. However, when it monitors that > server's log files (e.g. /var/log/messages), OSSEC inadvertently captures the > errors from other servers. This reesults in a duplicate alert because OSSEC > caught the issue on the original server and now once again on the syslog > server. > > How should I retify this problem? > > On an unrelated note: I know OSSEC runs as an unprivilege user (ossec), the > how > does it have read access to the log files that I specify in ossec.conf when I > don't allow world readable log files (as I should). > > Thanks in advance. > > -- > Hac Phan > Unix System Administrator > Network & Infrastructure, RSSP-IT > UC Berkeley > -- Wim Remes Security Afficionado
