On Mon, Dec 8, 2014 at 5:15 PM, David Lang <[email protected]> wrote: > On Thu, 4 Dec 2014, dan (ddp) wrote: > >> On Wed, Dec 3, 2014 at 7:51 PM, Jarrod Farncomb <[email protected]> >> wrote: >>> >>> Hi guys, >>> >>> I have some Juniper SSG devices which I need log in events to be reported >>> to >>> OSSEC so that they can be included within the daily report. >>> >>> From my research, the Juniper SSGs will specifc the OSSEC server as their >>> syslog server so that syslog messages are sent to the OSSEC server. >>> >>> My question is, what configuration is required on the OSSEC server in >>> order >>> for it to correctly listen for these events, log them, and report them? >>> As >>> this isn't an agent or agentless client I'm not sure what configuration >>> is >>> required so that OSSEC knows which device is sending the messages in and >>> what to do with them for instance. >>> >> >> I like using a syslog daemon to accept the log messages, and just have >> OSSEC read the log files on the system. >> Other people prefer to use OSSEC's syslog support. >> >> http://ossec-docs.readthedocs.org/en/latest/syntax/head_ossec_config.remote.html#element-connection > > > does ossec have the ability to listen to stdin rather than having to write > the logs to a file and have ossec scrape them? >
No, but using the syslog remoted option listens to the network instead. I just think it's not as good as an actual syslogd. > I'm looking to avoid having to worry about disk space for this sort of > config. > > David Lang -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
