Le 02/05/2012 20:10, A-Dubbs a écrit :
Will it at least significantly reduce the amount of alerts in the
alerts.log file? I just want to verify I am modifying the correct
settings for reducing alerts.
It will, yes, except for ... exceptions ;)
If don't have enough disk space to store the alerts.log history, you can
just delete the files. Basically, you are storing them twice already,
/var/ossec/logs/archives vs. /var/ossec/logs/alerts.
You want to store raw received logs (archives). Alerts logs are just
decoded archives and at least five times bigger (multi-lines for a
single raw log line).
In case you need to understand how a certain received log-line has been
treated, you still can re-decode it from archives.log using
ossec-logtest, but certainly, you never will.
Finally, to reduce the alerts.log file, if you are using ossec just to
centralize and store certain logs, create as many level 0 rules as
possible for these logs, they still will be stored, but never decoded:
they won't trigger alerts and won't be logged in alerts.log)
Hope it helps.
--
Cheers,
Florian Crouzat
