Use syslog, it's the closest. You'll have to write a decoder for it though. ossec-logtest can help with that.
On Tue, May 10, 2011 at 2:56 PM, drin brown <[email protected]> wrote: > Hi, > > Okay, this is probably the dumbest question on earth. I'm really > sorry. The manual for ossec is really sparse. Here goes. > > I want to monitor the active-response log from within my ossec.conf > Somewhere inside these list directives: > <localfile> > <log_format>syslog</log_format> > <location>/var/log/messages</location> > </localfile> > > So that I can get it to email me the changes when the file changes. > > But the log_format option... what do I put???
