On Wed, Sep 19, 2012 at 7:14 AM, Eero Volotinen <[email protected]> wrote: > 2012/9/19 Andreas Lang <[email protected]>: >> Hello, >> >> We have some questions regarding analysing log files with OSSEC referring to >> the log file requirements in PCI-DSS 10.5.5. >> >> PCI DSS 10.5.5.: >> Use file-integrity monitoring or change-detection software on logs to ensure >> that existing log data cannot be changed without generating alerts (although >> new data being added should not cause an alert). >> >> To cover this issue we wanted to enable real-time monitoring on our log file >> directories. Unfortunately we are getting this error: >> Ignoring flag for real time monitoring on directory: '/data/' >> >> Our servers are based on Ubuntu 10.04, 11.04 and 11.10, all x64 systems. We >> are using OSSEC 2.5 for clients and server. I know, that for real-time >> monitoring the tool inotify-tools must be installed, but unfortunately this >> didn’t resolve the issue. >> Do you have any suggestions have we can make the real-time monitoring of >> growing log files working correctly? > > how about installing samhain on ossec server to monitor ossec logs? > > -- > Eero
And Aide to monitor the samhain stuff!
