On Jan 12, 2016 6:42 AM, "theresa mic-snare" <[email protected]> wrote: > > yep, since the log files are tagged with a timestamp, like this: access_log-20160112 > i've configured: > "/home/*/logs/access_log_ssl-%Y%m%d" >
Strftime and globbing cannot be mixed http://ossec.github.io/docs/syntax/head_ossec_config.localfile.html > the log file itself doesn't have the ".log" extension..maybe this is causing the problem? > > Am Dienstag, 12. Januar 2016 12:32:54 UTC+1 schrieb dan (ddpbsd): >> >> >> On Jan 12, 2016 5:00 AM, "theresa mic-snare" <[email protected]> wrote: >> > >> > Hi, >> > >> > I have a webserver with many vhosts, and each webspace has its own home directory where the apache logs are located. >> > is there a way to use a wildcard like * to let the logcollector know in which directories to search, >> > I don't wanna configure each directory in the ossec.conf on the agent. >> > >> > i've tried /home/*/logs/ >> > but it doesn't seem possible in the ossec.conf >> > >> > I see a "ERROR: Glob error. Invalid pattern" >> > >> >> Did you try "/home/*/logs/log.log"? Somekind of globbing is available, but I can'tremember specifics (I don't use it). >> >> > what do you think? >> > >> > best, >> > theresa >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. >> >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
