You can try <location>. I can't find any real documentation on it at the moment, and I don't think I've done any real testing with it.
On Mon, Mar 7, 2011 at 3:49 PM, Shaikat Majumdar <[email protected]> wrote: > Does OSSEC pre-decoding provide a way to glean the log filename causing an > alert ? > > If not, can this be done using a custom-defined decoder ? > > -- > Shaikat Majumdar > Millburn Ridgefield Corporation >
