On Fri, Mar 1, 2013 at 5:09 AM, robert <[email protected]> wrote: > Hi all. We are running ossec 2.7 and sometimes we are not sure which log > file triggered an alert. Is there a way to include the log file that the > triggered the alert in the "Portion of the log(s)" part of the email body, > or anywhere in the body? I looked at the docs, and also the C source a bit, > and I didn't see what I was looking for. Any ideas? >
Some alerts already include this information: Received From: arrakis->/var/log/secure For others you'll have to modify the source. Perhaps the patches that allow for customization of the alerts make this functionality available. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
