On Jul 17, 2015 9:17 AM, "LGuerra" <[email protected]> wrote: > > I'm sorry on the original post I meant: > > with: > > u_ex150707.log -> u_ex%Y&m%d.log -> works fine for each file creation (daily) > > but with: > > u_ex15070723.log -> u_ex%Y&m%d%H.log -> It reads the file but I have to restart ossec otherwise it won't read it automatically (Hourly). >
Thanks for clarifying. You could try poking around the source code to see if you can spot the problem. I've never tried it, so I don't have much to go on. Creating an issue on github wouldn't hurt either. > Thanks > > sexta-feira, 17 de Julho de 2015 às 13:22:18 UTC+1, LGuerra escreveu: >> >> Hi, >> >> I found a few topics regarding IIS log rotation however, no one seems to have an easy answer for this. >> >> I have huge amount of IIS logs that can't be managed daily and so I have to set them to rotate hourly. Is there a way of getting OSSEC to refresh and read these files this way without having to restart agent? >> >> Example, I have these: >> >> u_ex15070723.log >> If I set them to "u_ex%Y%m%d.log" they will be read by ossec daily without a problem however if I have: >> >> u_ex15070723.log >> And I had to set as "u_ex%Y%m%d%H.log" This way, Ossec won't read files hourly. I have to restart it manually or by batch which, I think, it's not the correct/best way (It will pollut the logs). >> >> Does anyone knows a way of achieving this without restarting? >> >> Thanks! > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
