Well, stoping OSSEC loggingg to log files is not really the problem, I can handle that with a script...
What I really would like to have is all the logs into mysql because the volume of generated logs is too important to be crawled with a single script :( I really can not understand why mysql shows me all the INSERT and UPDATE commands but does not execute them (not anymore, it worked only for 12 lines)... Le jeudi 10 mai 2012 14:44:03 UTC+2, dan (ddpbsd) a écrit : > > On Thu, May 10, 2012 at 8:35 AM, Scott VR wrote: > > Well, like dan I don't actually use it, but like you, I have configured > it. > > > > What dan said about writing code is of interest here, I think.. And > might be > > the key to what you want. Perhaps Dan will elaborate on what he meant. > Maybe > > the database feature is incomplete, hence his suggestion that you fire > up a > > text editor? > > > > Scott > > > > It works for most people, and I think it's used heavily by some > users.While I don't think the db stuff is feature complete, that's not > what I meant. > > There is currently no way to not log to text files, and to change that > you'd have to modify the source code. This isn't something I'd > consider a feature though. > > > > > > On May 10, 2012, at 4:36 AM, secatoor wrote: > > > > Hi Scott, > > > > Yes I did configure the "database output", otherwise we wouldn't see the > > actions in mysql.log, these are the parameters I used: > > > > <database_output> > > <hostname>localhost</hostname> > > <username>ossecuser</username> > > <password>password</password> > > <database>ossec</database> > > <type>mysql</type> > > </database_output> > > > > There must be something wrong with mysql, is ther something (timeout or > > maxConnection) that I should change ? > > > > Le mercredi 9 mai 2012 18:35:32 UTC+2, Scott VR a écrit : > >> > >> > >> > >> > >> > >> On May 9, 2012, at 6:16 AM, secatoor wrote: > >> > >> > Is there something specific I have to tell OSSEC to make it stop > >> > logging into log files and log into mysql database ? > >> > > >> > >> Did you set database_output and appropriate credential, etc parameters > in > >> ossec.conf? > >> > >> See http://www.ossec.net/doc/manual/output/database-output.html > >> > >> It sounds like you completed "Enabling database support", but missed > >> "Enabling database output in configuration" perhaps. > >> > >> ScottVR > >> > >> > I tried starting it again and again but it still does not work fine > (I > >> > even tried from scratch, with no previous installation)... > >> > > >> > If someone has any idea, you're welcome ;) > >> > Thanks >
