On Thu, Jul 6, 2017 at 5:05 PM, Kazim Koybasi <[email protected]> wrote: > Thanks for quick response. > > Server has running apache , I restarted apache it show log that it monitors > all apache config and I connect with my browser and made multple 404 error > codes from same server . default log level is 7 for ossec. OSSEC exact > configuration like below and my server hosts 7 vhost so there is so much > log. Can the reason of that from type of apache server log format? For > example my apache has some server combined log format and some other common > log format. > > <location>/var/log/httpd/*/*_log</location> >
And in the ossec.log file it mentions monitoring these log files? I'm not sure what the log format should be for apache. I think it's the default, or was the default when the decoder was written. If you make changes to the log format, it will cause issues. > > On Thursday, 6 July 2017 23:37:55 UTC+3, Kazim Koybasi wrote: >> >> I added config below to etc/shared/agent.conf in ossec-server home >> directory but there is no alerts in server.What could I need with this >> configuration? >> >> >> <agent_config name="agent4"> >> <localfile> >> <log_format>apache</log_format> >> <location>/var/log/httpd/site/site_log</location> >> </localfile> >> </agent_config> >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
