On Fri, Jun 7, 2013 at 9:40 AM, Nalin Gupta <[email protected]> wrote: > Hi, > > We have OSSEC setup using a server/agent configuration, which is configured > to log files like /var/log/auth.log, /var/log/nginx/access.log etc. All this > files are in the configuration file (/var/ossec/etc/ossec.conf) of both > agent. Connection between server and agent are good. > > Ossec manual says that the logs are collected and stored on the manager at > sub-directories of /var/ossec/logs/. However, my ossec manager only contains
Where does it say this? I will correct it. > the following files and folders at this /var/ossec/logs/ : > active-responses.log alerts archives firewall ossec.log > > I am confused. Isn't ossec manager supposed to collect a copy of logs from > each of its client and store it at its end ? Where is this stored ? > > The logs that are stores are OSSEC logs and alerts. If you want to keep a copy of all logs passed to OSSEC, you have to turn on the log all option on the server. This will keep a copy of all logs in /var/ossec/logs/archives. > Thanks in advance. > Nalin > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
