Hopefully this doesn’t go through twice (first message never went through).
I have syslog outputting to splunk with minimum level set to 6. However,
everything is being sent to splunk. The level option is not being obeyed by
OSSEC. I’ve disabled and enabled client-syslog multiple times. Restarted
OSSEC and the entire server as well. I am trying to prevent windows logon
successes and logoffs (level 3) as they are eating up my 500mb daily limit
in splunk. So, I’m not sure why OSSEC is not obeying the min. level
parameter. OSSEC and Splunk are both on the same server.
<syslog_output>
<level>6</level>
<server>127.0.0.1</server>
<port>10002</port>
<format>splunk</format>
</syslog_output>
Any help would be appreciated! Thanks!
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
