How do I specify which format should be used to parse logs that are sent to
an OSSEC server by agents on remote hosts? I have an Apache server with an
OSSEC agent, which sends its logs to an OSSEC server for analysis. However,
the server attempts to parse these logs using the syslog format, which of
course fails and generates many "Unknown problem" alerts. I tried the
following setting in ossec.conf on both the client and the server, but
OSSEC still uses the wrong format to parse the Apache logs:
<localfile>
<log_format>apache</log_format>
<location>/var/log/httpd/error_log</location>
</localfile>
What is the right way to tell OSSEC to use the apache log format for logs
from client servers?
Craig
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
