On Thu, Sep 1, 2016 at 10:10 AM, Olivier Doisneau <[email protected]> wrote: > So I changed my ossec.conf to have this: > > <syslog_output> > > <server>127.0.0.1</server> > > <port>8089</port> > > <format>default</format> > > </syslog_output> > > > and /var/ossec/bin/ossec-csyslogd > > is started. But I don't see any attempts to push the logs coming in to > syslog in the ossec.log file. >
The ossec.log doesn't usually contain logs that it's logging. You should be able to see the alerts via tcpdump on the ossec manager: `tcpdump -nn port 8089` > > Thanks > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
