Hi all. I am using srlog2 to transport logs to the central server and the problem is that srlog adds tai64nlocal timestamp to every standart syslog message.
Here is an example: @4000000051594d5228e8290c Apr 1 15:03:14 xxx su: BAD SU yyy to toor on /dev/pts/0 @4000000051594d54207e0034 Apr 1 15:03:16 xxx su: yyy to toor on /dev/pts/0 I believe, i just need a custom predecoder, to cut out tai64 timestamp and then process as a usual syslog message. Is there any ways to achive that? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
