What is the purpose of this central ossec server? If you only want logging purposes maybe could be more easy send from each ossec server the events output via syslog to a central logging system (for example graylog2).
El miércoles, 1 de agosto de 2012 05:01:09 UTC+2, Patrick escribió: > > Hi, > > We're looking at OSSEC and I'm wondering if it supports the following > config Ossec Agent -> Ossec Server -> Ossec Server? > > We have multiple LAN segments and want to have a central OSSEC aggregation > point in each segment, then have that aggregation point forward logs to a > central OSSEC server. > > I already have OSSEC agents talking to their respective OSSEC agg point in > their zone, however need assistance getting the agg points talking to the > final OSSEC server. > > Is this supported/achievable? > > Thank you for any info you can provide. > > Pat >
