On Feb 9, 2016 9:08 PM, "Craig Finch" <[email protected]> wrote: > > How do I specify which format should be used to parse logs that are sent to an OSSEC server by agents on remote hosts? I have an Apache server with an OSSEC agent, which sends its logs to an OSSEC server for analysis. However, the server attempts to parse these logs using the syslog format, which of course fails and generates many "Unknown problem" alerts. I tried the following setting in ossec.conf on both the client and the server, but OSSEC still uses the wrong format to parse the Apache logs: > > <localfile> > > <log_format>apache</log_format> > > <location>/var/log/httpd/error_log</location> > > </localfile> > > > What is the right way to tell OSSEC to use the apache log format for logs from client servers? >
Analysisd uses the format it detects while predecoding the log events. If the log message is in the wrong format, you can either change the format apache logs in or modify the decoder on the server. > > Craig > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
