On Wed, Dec 3, 2014 at 7:51 PM, Jarrod Farncomb <[email protected]> wrote: > Hi guys, > > I have some Juniper SSG devices which I need log in events to be reported to > OSSEC so that they can be included within the daily report. > > From my research, the Juniper SSGs will specifc the OSSEC server as their > syslog server so that syslog messages are sent to the OSSEC server. > > My question is, what configuration is required on the OSSEC server in order > for it to correctly listen for these events, log them, and report them? As > this isn't an agent or agentless client I'm not sure what configuration is > required so that OSSEC knows which device is sending the messages in and > what to do with them for instance. >
I like using a syslog daemon to accept the log messages, and just have OSSEC read the log files on the system. Other people prefer to use OSSEC's syslog support. http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.remote.html#element-connection > Thanks for any help! > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
