Thanks Glen and Dan. I was able to change the rsyslog format to include the IP address, have custom decoder to extract the scrip from the log message (not from log message header), then use AR to do what to agentless file integrity check.
I wanted to do agentless file integrity check whenever a machine is restarted, so I have a logger statement in rc.d to send to central rsyslog server, it has agent on it. If it detects "system restarted fro 1.2.3.4" then AR will use agentless script to do file integrity check. Did lots of ossec-logtest and it seems to work now. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
