Hello, I have just upgraded from 2.5.1 to 2.6 and I no longer get remote 
syslog messages in the logs (all was working before the upgrade).  I wanted 
to get on the latest stable version and keep it up-to-date.

Here is a portion of my ossec.conf:

  <remote>
    <connection>syslog</connection>
    <allowed-ips>0.0.0.0/0</allowed-ips>
  </remote>

  <remote>
    <connection>secure</connection>
  </remote>

  <alerts>
    <log_alert_level>1</log_alert_level>
    <email_alert_level>7</email_alert_level>
  </alerts>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/secure.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/system.log</location>
  </localfile>


Netstat/lsof/ps shows that ossec-remoted has the connection open.  I *am* 
getting 
local syslog information, just not remote.

I inherited this ossec installation and am not all that familiar with it, 
but I have read the manual and studied all of the config entries -- but I'm 
not sure where to look now.

Can someone help me get this going again?

Thanks,

Scott

Reply via email to