On Jul 17, 2015 8:22 AM, "LGuerra" <[email protected]> wrote: > > Hi, > > I found a few topics regarding IIS log rotation however, no one seems to have an easy answer for this. > > I have huge amount of IIS logs that can't be managed daily and so I have to set them to rotate hourly. Is there a way of getting OSSEC to refresh and read these files this way without having to restart agent? > > Example, I have these: > > u_ex15070723.log > If I set them to "u_ex%Y%m%d.log" they will be read by ossec daily without a problem however if I have: > > u_ex15070723.log > And I had to set as "u_ex%Y%m%d%H.log" This way, Ossec won't read files hourly. I have to restart it manually or by batch which, I think, it's not the correct/best way (It will pollut the logs). >
This logfile does not appear to have an hour in the name, so the %H shouldn't match at all. > Does anyone knows a way of achieving this without restarting? > > Thanks! > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
