On Thu, 4 Dec 2014, dan (ddp) wrote:
On Wed, Dec 3, 2014 at 7:51 PM, Jarrod Farncomb <[email protected]> wrote:
Hi guys,
I have some Juniper SSG devices which I need log in events to be reported to
OSSEC so that they can be included within the daily report.
From my research, the Juniper SSGs will specifc the OSSEC server as their
syslog server so that syslog messages are sent to the OSSEC server.
My question is, what configuration is required on the OSSEC server in order
for it to correctly listen for these events, log them, and report them? As
this isn't an agent or agentless client I'm not sure what configuration is
required so that OSSEC knows which device is sending the messages in and
what to do with them for instance.
I like using a syslog daemon to accept the log messages, and just have
OSSEC read the log files on the system.
Other people prefer to use OSSEC's syslog support.
http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.remote.html#element-connection
does ossec have the ability to listen to stdin rather than having to write the
logs to a file and have ossec scrape them?
I'm looking to avoid having to worry about disk space for this sort of config.
David Lang
