On Mon, Dec 6, 2010 at 2:49 PM, Christopher Moraes <[email protected]> wrote: > Hi, > I have a centralized syslog that contains logs from Windows and Unix hosts > (and devices). The logs are all single line logs, but with different > signatures. > E.g. the windows event log format is > Sep 18 00:01:06 TXXXXXX2.syxxxxxd.com MSWinEventLog ....... > A sample unix log format is > Sep 18 00:01:02 10.111.114.88 sshd: ..... > I have setup ossec to read the file and specified the <log_format> as > "syslog". > However, whenever ossec comes across the windows event logs, it throws an > alert "Unknown problem somewhere in the system". > I went through the syslog_rules.xml and found that this error is caused > because the log is not in the format supported by the syslog decoder. > Is there anyway I can get ossec to read the log line and check which decoder > matches the log before processing the log? > Thanks and regards, > Chris >
If the format of the messages is wrong, they won't be decoded correctly. You have messages in non-syslog format going to a file where ossec expects syslog formatted messages. As you can see, this will cause issues. > > On Tue, Oct 5, 2010 at 2:58 PM, Christopher Moraes <[email protected]> > wrote: >> >> Hi, >> We're using syslog-ng to centralize logs on a server. The way the system >> is setup is that *all* system logs (for unix, windows, apache, iis, etc) get >> written to a single file on the syslog server. >> Can OSSEC be configured to analyse this type of combined syslog file? >> Regards, >> Chris >> >> > >
