okay, I see. thanks for the explanation. syscheck is done every 22 hours by default, so that is what I mean by "new syscheck".
cheers On 6 September 2016 at 10:22, Pedro Sanchez <[email protected]> wrote: > Hi Daiyue, > > I don't really understand what you mean for "new syscheck" is replacing > previous logs, please could you explain this in detail? > > Regarding to the rotation of alerts.log, we can't configure the log size, > it is rotating daily no matter how much weights, it will rotate every day. > If you open etc/internal_options.conf you will be able to enabled/disabled > compression, but nothing related to log size. > > Best regards, > > Pedro S. > > On Tue, Sep 6, 2016 at 10:11 AM, Daiyue Weng <[email protected]> wrote: > >> Hi, I found that alerts.log is rotating that previous logs were replaced >> by new syschecks, so any way to configure ossec to record previous logs, >> like increasing log size? >> >> cheers >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> > > -- > > --- > You received this message because you are subscribed to a topic in the > Google Groups "ossec-list" group. > To unsubscribe from this topic, visit https://groups.google.com/d/ > topic/ossec-list/RkBWz1U-wwg/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
