On Fri, Aug 17, 2012 at 5:49 PM, JB <[email protected]> wrote: > The allowed value for <remote><connection> is either 'secure' or 'syslog' > according to http://www.ossec.net/doc/syntax/head_ossec_config.remote.html > > It seems strange that you have both values in your ossec.conf. > Try get rid of the second <remote> below. > > <remote> > <connection>syslog</connection> > <allowed-ips>10.5.4.1</allowed-ips> > <port>514</port> > </remote> > > <remote> > <connection>secure</connection> > </remote> >
This is a valid configuration, and it generally works. 2 remoted instances are run, 1 listening to 1514 and the other 514.
