The alerts need to be from ossec, not the cisco device directly. You can run the asa logs through logtest to get this format.
-----Original Message----- From: Kai Sent: 01/26/2011 5:20:45 AM Subject: [ossec-list] Generating Cisco ASA Reports Hello, i'm trying to create a report based on a asa logfile which has the following format (ip,port replaced): Jan 19 09:23:47 123.456.789.012 %ASA-1-123456: TCP access denied by ACL from 999.123.456.123/3240 to outside:123.142.432.23/65 This is what i get: cat /tmp/log | /tmp/ossec-hids-2.5.1/src/monitord/ossec-reportd -n "Daily Log Test" 2011/01/26 11:11:51 ossec-reportd: INFO: Started (pid: 52310). 2011/01/26 11:11:58 ossec-reportd: INFO: Report 'Daily Log Test' completed and zero alerts post-filter. The logfile is really big, and i don't believe that there are no alerts at all. regards, Kai
