You may need to modify src/analysisd/cleanevent.c, which skips certain prefixes with known format. On Monday, April 1, 2013 6:33:48 AM UTC-7, Андрей Шевченко wrote: > > Hi all. > > I am using srlog2 to transport logs to the central server and the problem > is that srlog adds tai64nlocal timestamp to every standart syslog message. > > Here is an example: > @4000000051594d5228e8290c Apr 1 15:03:14 xxx su: BAD SU yyy to toor on > /dev/pts/0 > @4000000051594d54207e0034 Apr 1 15:03:16 xxx su: yyy to toor on /dev/pts/0 > > I believe, i just need a custom predecoder, to cut out tai64 timestamp and > then process as a usual syslog message. > Is there any ways to achive that? > >
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
