hmm, i think i might have identified the problem... the ossec docs say strftime and wildcards cannot be used on the same entry.
strftime make it possible to tag file names with timestamps right? but it seems it's not possible to combine it with wildcards in filenames :(((( it looks like i need to specify the logs for each home directory...meh Am Dienstag, 12. Januar 2016 12:42:17 UTC+1 schrieb theresa mic-snare: > > yep, since the log files are tagged with a timestamp, like this: > access_log-20160112 > i've configured: > "/home/*/logs/access_log_ssl-%Y%m%d" > > the log file itself doesn't have the ".log" extension..maybe this is > causing the problem? > > Am Dienstag, 12. Januar 2016 12:32:54 UTC+1 schrieb dan (ddpbsd): >> >> >> On Jan 12, 2016 5:00 AM, "theresa mic-snare" <[email protected]> wrote: >> > >> > Hi, >> > >> > I have a webserver with many vhosts, and each webspace has its own home >> directory where the apache logs are located. >> > is there a way to use a wildcard like * to let the logcollector know in >> which directories to search, >> > I don't wanna configure each directory in the ossec.conf on the agent. >> > >> > i've tried /home/*/logs/ >> > but it doesn't seem possible in the ossec.conf >> > >> > I see a "ERROR: Glob error. Invalid pattern" >> > >> >> Did you try "/home/*/logs/log.log"? Somekind of globbing is available, >> but I can'tremember specifics (I don't use it). >> >> > what do you think? >> > >> > best, >> > theresa >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
