On Feb 12, 2015 8:50 PM, "Network Infrastructure" <panhatiger...@gmail.com> wrote: > > When I checked it in /var/ossec/logs/ossec.log I see that: > > > remote syslog allowed from: '192.168.10.1' >
That was the ip you gave it in the ossec.conf. i believe that should be the ip of your asa device. If it is not, please give me the ip of your asa device so i can give you the configuration you should use. > So, I think we have problem with decoder file. > No, that's absurd. The decoder.xml has nothing tk do with this. Are you trolling? > On Friday, February 6, 2015 at 9:11:33 AM UTC+7, Network Infrastructure wrote: >> >> I have configured OSSEC to monitor my ASA 5520 but I cannot see anything >> >> In ASA 5520, I enable syslog server to send syslog to my OSSEC >> >> >> In OSSEC, the /var/ossec/etc/ossec.conf, I configed: >> >> <ossec_config> >> >> <remote> >> <connection>syslog</connection> >> <allowed-ips>IP_OF_CISCO_DEVICE</allowed-ips> >> </remote> >> <global> >> <logall>yes</logall> >> </global> >> >> </ossec_config> >> >> Then I restart ossec services but I cannot see anything. >> >> >> Help me please ... > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
