What did you change exactly? diff?
On Sat, Aug 6, 2011 at 12:14 PM, jplee3 <[email protected]> wrote: > Nevermind my last comment about ossec.conf not being read properly. I > must have not saved it after editing...doh. > > It seems to work fine. But agent.conf doesn't seem to be processed in > still. > > On Aug 5, 4:54 pm, jplee3 <[email protected]> wrote: >> Hi all, >> >> So we ran into an issue with "Large message size" warnings filling up >> the ossec.log file and causing the file to grow out of control and use >> up disk space. I went ahead and commented out the lines in >> read_syslog.c and read_multiline.c to prevent this from happening in >> the future, but then noticed after starting OSSEC back up, that the >> full commands weren't running. >> >> I made sure to backup the original ossec-logcollector, and when I >> restored it and restarted OSSEC, the full commands showed up as >> running in the ossec.log >> >> At first I thought it was the changes I made with commenting out the >> "Large message size" lines, so I deleted the dir, untarred to a fresh >> folder, and compiled straight away. Copied the ossec-logcollector >> over, restarted OSSEC, and no go with full command. >> >> Is there something I'm missing when compiling in src/logcollector? I >> noticed that read_fullcommand.c does exist in this directory.
