Hi there! I'm interested about this test too. Anyone maybe profile could fit your needs ?
http://ossec-docs.readthedocs.org/en/latest/syntax/head_agent_config.html#options Good read https://groups.google.com/forum/#!topic/ossec-list/KKdsgYDiiks https://groups.google.com/forum/#!topic/ossec-list/L32Fbdz1AiU Thanks On Tue, Feb 10, 2015 at 10:23 AM, dan (ddp) <[email protected]> wrote: > On Tue, Feb 10, 2015 at 7:00 AM, Ricardo Perre <[email protected]> wrote: > > Hello, > > > > Is it possible to define a profile based on "name" filtered by regex? > > In documentation we have: > > > > > > <agent_config name="agent1"> > > <localfile> > > <location>/var/log/my.log</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > <agent_config os="Linux"> > > <localfile> > > <location>/var/log/my.log2</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > <agent_config os="Windows"> > > <localfile> > > <location>C:\myapp\my.log</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > > > > > Can i use something like this? > > > > > > <agent_config name="REGEX"> > > <localfile> > > <location>/var/log/my.log</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > > > <agent_config os="Linux"> > > <localfile> > > <location>/var/log/my.log2</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > <agent_config os="Windows"> > > <localfile> > > <location>C:\myapp\my.log</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > Try it and report back. > > > > > Thanks for your time. > > > > Thank you for yours. > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [email protected]. > > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- Rodrigo Montoro (Sp0oKeR) http://spookerlabs.blogspot.com http://www.twitter.com/spookerlabs http://www.linkedin.com/in/spooker -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
