I'm sorry on the original post I meant: with:
u_ex150707.log -> u_ex%Y&m%d.log -> works fine for each file creation (daily) but with: u_ex15070723.log -> u_ex%Y&m%d%H.log -> It reads the file but I have to restart ossec otherwise it won't read it automatically (Hourly). Thanks sexta-feira, 17 de Julho de 2015 às 13:22:18 UTC+1, LGuerra escreveu: > Hi, > > I found a few topics regarding IIS log rotation however, no one seems to > have an easy answer for this. > > I have huge amount of IIS logs that can't be managed daily and so I have > to set them to rotate hourly. Is there a way of getting OSSEC to refresh > and read these files this way without having to restart agent? > > Example, I have these: > > u_ex15070723.log > If I set them to "u_ex%Y%m%d.log" they will be read by ossec daily > without a problem however if I have: > > u_ex15070723.log > And I had to set as "u_ex%Y%m%d%H.log" This way, Ossec won't read files > hourly. I have to restart it manually or by batch which, I think, it's not > the correct/best way (It will pollut the logs). > > Does anyone knows a way of achieving this without restarting? > > Thanks! > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
