As can be seen here: http://www.ossec.net/wiki/Know_How:Email_Alerts_below_7 the name of the logfile is generally in the alert ("Received From: (foo) 192.168.0.2->/var/log/messages"). If it isn't in your alert message, you can use grep if you're on a sane(r) system. I'm not sure how to find it with Windows.
On Wed, Feb 16, 2011 at 3:06 PM, OSSEC <[email protected]> wrote: > Hey Dan, > > bai-mw1 is the name of the agent. How i can find out the log that > message is hidden? > > thanks > > On Feb 16, 2:50 pm, "dan (ddp)" <[email protected]> wrote: >> Hi Chris, >> Find out what BAI-MW1 is. Knowing which log that message is hidden in >> might be useful. >> Then write a rule for the log message. >> >> >> >> >> >> >> >> On Wed, Feb 16, 2011 at 2:46 PM, OSSEC <[email protected]> wrote: >> > Greetings, >> >> > all of the sudden i've started receiving the following error message >> >> > "Unknown problem somewhere in the system." >> > Portion of the log(s): >> >> > Feb 16 14:35:43 BAI-MW1 : error initializing: -1 >> >> > I;ve restarted the agents and servers but i still having the same >> > issue. These alerts are coming out of few agents not all of them. >> >> > ANy ideas please? >> >> > thanks
