Assuming you're using the OSSEC app for Splunk, it's probably indexing the local alerts file.
You don't actually need to configure the syslog output on the OSSEC side if both are on the same server and you want to capture everything. But since you want to limit the data coming in, you can use the syslog option and disable the other input. In the GUI, look under Settings->Data Inputs->Files & Directories and disable the entry for /var/ossec/logs/alerts/alerts* Also, using <format>splunk</format> is generally not needed or recommended if you're using the app. It seems counterintuitive I know, but that option was added well after the Splunk app for OSSEC was written. On Fri, Jun 20, 2014 at 10:24 AM, cschwieterman <[email protected]> wrote: > Hopefully this doesn’t go through twice (first message never went through). > > I have syslog outputting to splunk with minimum level set to 6. However, > everything is being sent to splunk. The level option is not being obeyed by > OSSEC. I’ve disabled and enabled client-syslog multiple times. Restarted > OSSEC and the entire server as well. I am trying to prevent windows logon > successes and logoffs (level 3) as they are eating up my 500mb daily limit > in splunk. So, I’m not sure why OSSEC is not obeying the min. level > parameter. OSSEC and Splunk are both on the same server. > > <syslog_output> > > <level>6</level> > > <server>127.0.0.1</server> > > <port>10002</port> > > <format>splunk</format> > > </syslog_output> > > Any help would be appreciated! Thanks! > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
