On Thu, May 10, 2012 at 8:35 AM, Scott VR <[email protected]> wrote: > Well, like dan I don't actually use it, but like you, I have configured it. > > What dan said about writing code is of interest here, I think.. And might be > the key to what you want. Perhaps Dan will elaborate on what he meant. Maybe > the database feature is incomplete, hence his suggestion that you fire up a > text editor? > > Scott >
It works for most people, and I think it's used heavily by some users.While I don't think the db stuff is feature complete, that's not what I meant. There is currently no way to not log to text files, and to change that you'd have to modify the source code. This isn't something I'd consider a feature though. > > On May 10, 2012, at 4:36 AM, secatoor <[email protected]> wrote: > > Hi Scott, > > Yes I did configure the "database output", otherwise we wouldn't see the > actions in mysql.log, these are the parameters I used: > > <database_output> > <hostname>localhost</hostname> > <username>ossecuser</username> > <password>password</password> > <database>ossec</database> > <type>mysql</type> > </database_output> > > There must be something wrong with mysql, is ther something (timeout or > maxConnection) that I should change ? > > Le mercredi 9 mai 2012 18:35:32 UTC+2, Scott VR a écrit : >> >> >> >> >> >> On May 9, 2012, at 6:16 AM, secatoor wrote: >> >> > Is there something specific I have to tell OSSEC to make it stop >> > logging into log files and log into mysql database ? >> > >> >> Did you set database_output and appropriate credential, etc parameters in >> ossec.conf? >> >> See http://www.ossec.net/doc/manual/output/database-output.html >> >> It sounds like you completed "Enabling database support", but missed >> "Enabling database output in configuration" perhaps. >> >> ScottVR >> >> > I tried starting it again and again but it still does not work fine (I >> > even tried from scratch, with no previous installation)... >> > >> > If someone has any idea, you're welcome ;) >> > Thanks
