On Tue, 10 Feb 2015, Mehul gajjar wrote:
Installed and configured OSSEC 2.8.1 with 4 Agents. work fine. I need to
know how to enabled OSSEC for central logging system. so Agent logs store
on servers.
I have configured logall but no luck.
you have a hammer, so everything looks like a nail.
Ossec is not the right tool for your centralized logging solution. Yes it can
gather logs, but it's very limited in what it can do with them. There are a lot
of things that you need to take into account. Ossec uses the syslog protocol (in
it's simplist forms), but take a look at the article below for info on the wider
set of things you need to consider when planning a centralized logging system
(later articles in the series go into more depth on particular tools and issues)
https://www.usenix.org/publications/login/august-2013-volume-38-number-4/enterprise-logging
David Lang
