Jeremy, In case I am using the OSSEC Agent, I think, my steps goes like, configuring mod-security to log its events in *error_log* file at the server end.Then I can reconfigure the agent to monitor the logs of eeror_log file and send it to tthe serevr, which will parse these logs in accordance to the apache_rules.xml file. and hence display the same.
I dnt understand then where is the need to setup log forwarding in the Apache settings to get your Apache logs to forward to a syslog server. & How do i do that ? Regards Tanishk On Sat, Feb 5, 2011 at 1:35 AM, Jeremy Lee <[email protected]> wrote: > I don't know if "/var/log/messages local7.*" is correct > > However, the second line is correct. > > BUT, I think I was initially incorrect about the 2nd option when advising > it. If the logs are logging to Apache logs, which they should be default, > then I believe you actually need to setup log forwarding in the Apache > settings to get your Apache logs to forward to a syslog server. > > Read through these threads: > > http://forums.whirlpool.net.au/archive/1363249 > > http://www.unix.com/red-hat/127828-sending-all-apache-logs-syslog-server.html > > > So you can either use logger to accomplish this or you can add the syslog > directive (the latter would be the recommended way). > > Is there a reason why you are avoiding use of the OSSEC agent? > > > > On Fri, Feb 4, 2011 at 11:07 AM, tanishk lakhaani > <[email protected]>wrote: > >> Hey thanks for replying !!!! >> >> Well I am trying the second option. Can u pls gimme some information on >> how to set up log forwarding via syslog >> >> What I tried was (in /etc/syslog.conf): >> >> /var/log/messages <tab_space> local7.* >> local7.* <tab_space> @ServerIP >> >> Am i doing the right way ? >> >> Regards >> Tanishk >> >> On Sat, Feb 5, 2011 at 12:23 AM, Jeremy Lee <[email protected]> wrote: >> >>> Do you have the OSSEC agent installed on the same box that ModSecurity is >>> on? And is ModSec logging to the Apache logs? If so, make sure the OSSEC >>> agent is monitoring the Apache logs and on your OSSEC server be sure to tune >>> the ModSec rules (should be in the apache_rules.xml) to log/alert as >>> required. >>> >>> Or, are you trying to forward the ModSec logs via syslog? If so you'll >>> have to setup log forwarding via syslog/syslog-ng/rsyslog. >>> >>> >>> >>> >>> >>> On Fri, Feb 4, 2011 at 10:41 AM, tanishk lakhaani <[email protected] >>> > wrote: >>> >>>> Hi all, >>>> I have deployed Mod-Security, bt I am unable to forward the logs of >>>> Mod-Security to the OSSEC Server as well as a SIEM. >>>> >>>> Can anyone help me in fixing this. >>>> Regards >>>> Tanishk >>>> >>> >>> >> >> >> -- >> warm regards >> Tanishk Lakhaani >> > > -- warm regards Tanishk Lakhaani
