Gil, nice to see you here. On the agent servers, I use the following in /var/ossec/etc/ossec.conf and it works:
<localfile>
<log_format>syslog</log_format>
<location>/var/log/proftpd/current</location>
</localfile>
What you may want to do, if you are not yet up to IPv6 is turn off IPv6 and
that will get rid of the "::ffff:" entries which are probably the culprit.
Thank you.
