Hi, I've got problem when I added more logging and one of my monitored logfiles grow to over 2GB. The logcollector will not read the logfile if it's bigger than 2 GB when the logcollector starts, see log below. If the logfile is smaller than 2GB when the logcollector starts there is no problem. When the logfile grow to more than 2GB the logcollector still works if it was started when the logfile was smaller than 2GB. Output from the ossec.log; 2013/03/14 09:17:02 ossec-logcollector(1116): ERROR: Error handling file '/logpool/audit/audit' (fseek). 2013/03/14 09:17:02 ossec-logcollector(1950): INFO: Analyzing file: '/logpool/audit/audit'. 2013/03/14 09:17:02 ossec-logcollector: INFO: Started (pid: 27684). 2013/03/14 09:19:13 ossec-logcollector(1904): INFO: File not available, ignoring it: '/logpool/audit/audit'. I've also tried to compile the logcollector with -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 flags with no luck. I run Ossec 2.7 on a Solaris 10, SPARC system and i have used used both UFS and ZFS. any ideas? rgds /Peter
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
