Hi Daiyue, I don't really understand what you mean for "new syscheck" is replacing previous logs, please could you explain this in detail?
Regarding to the rotation of alerts.log, we can't configure the log size, it is rotating daily no matter how much weights, it will rotate every day. If you open etc/internal_options.conf you will be able to enabled/disabled compression, but nothing related to log size. Best regards, Pedro S. On Tue, Sep 6, 2016 at 10:11 AM, Daiyue Weng <[email protected]> wrote: > Hi, I found that alerts.log is rotating that previous logs were replaced > by new syschecks, so any way to configure ossec to record previous logs, > like increasing log size? > > cheers > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
