Do you have the OSSEC agent installed on the same box that ModSecurity is on? And is ModSec logging to the Apache logs? If so, make sure the OSSEC agent is monitoring the Apache logs and on your OSSEC server be sure to tune the ModSec rules (should be in the apache_rules.xml) to log/alert as required.
Or, are you trying to forward the ModSec logs via syslog? If so you'll have to setup log forwarding via syslog/syslog-ng/rsyslog. On Fri, Feb 4, 2011 at 10:41 AM, tanishk lakhaani <[email protected]>wrote: > Hi all, > I have deployed Mod-Security, bt I am unable to forward the logs of > Mod-Security to the OSSEC Server as well as a SIEM. > > Can anyone help me in fixing this. > Regards > Tanishk >
