Hi Saket, On Wed, Dec 29, 2010 at 6:23 PM, Saket <[email protected]> wrote: > This is what I was looking for. > > Can you tell me where to find > <syslog_output> > <server>192.168.4.1</server> > </syslog_output> > > <syslog_output> > <level>10</level> > <server>10.1.1.1</server> > </syslog_output> > > I looked up ossec.conf , should I include it there? > > Thanks, > Saket >
Yes, this configuration belongs in the ossec.conf on the manager. > > On Dec 29, 3:42 pm, Jeremy Lee <[email protected]> wrote: >> Seems you can forward alerts to a syslog >> server:http://www.ossec.net/dcid/?p=139 >> >> Not sure about the actual ossec.log entries. >> >> On Wed, Dec 29, 2010 at 12:34 PM, Saket <[email protected]> wrote: >> > Hi, >> >> > I am trying to forward the OSSEC logs to a syslog server. >> >> > I know it stores the logs in /ossec/logs/ossec.log file and >> > /ossec/logs/alerts/alerts.log >> >> > But, is there a way to send these logs to a syslog server? >> >> > Thanks, >> > Saket
