Hello, i'm trying to create a report based on a asa logfile which has the following format (ip,port replaced):
Jan 19 09:23:47 123.456.789.012 %ASA-1-123456: TCP access denied by ACL from 999.123.456.123/3240 to outside:123.142.432.23/65 This is what i get: cat /tmp/log | /tmp/ossec-hids-2.5.1/src/monitord/ossec-reportd -n "Daily Log Test" 2011/01/26 11:11:51 ossec-reportd: INFO: Started (pid: 52310). 2011/01/26 11:11:58 ossec-reportd: INFO: Report 'Daily Log Test' completed and zero alerts post-filter. The logfile is really big, and i don't believe that there are no alerts at all. regards, Kai
