I have had luck with the following config for DHCP logs.
<localfile>
<location>%windir%/sysnative/Dhcp/DhcpSrvLog-%a.log</location>
<log_format>syslog</log_format>
</localfile>
On Tue, Sep 19, 2017 at 2:40 PM, <[email protected]> wrote:
> Hello OSSEC Team,
>
> I need your help to understand what the following error means.
>
> So I have added the following changes into the agent's config file to be
> able to read DHCP logs:
>
> <localfile>
> <location>%windir%/System32/Dhcp/DhcpSrvLog-%a.log</location>
> <log_format>syslog</log_format>
> </localfile>
>
>
> But I get the following related messages in the ossec log:
>
> 2017/09/19 13:06:13 ossec-logcollector(1952): INFO: Monitoring variable
> log file: 'C:\Windows/System32/dhcp/DhcpSrvLog-Tue.log'.
> 2017/09/19 13:06:13 ossec-logcollector(1103): ERROR: Could not open file
> 'C:\Windows/System32/dhcp/DhcpSrvLog-Tue.log' due to [(9)-(Bad file
> descriptor)].
> 2017/09/19 13:06:13 ossec-logcollector(1950): INFO: Analyzing file:
> 'C:\Windows/System32/dhcp/DhcpSrvLog-Tue.log'.
>
>
> I have tried changing the "/" to "\", but the same error ensues.
>
> Does anybody know what that "bad file descriptor" means? I am not sure
> what OSSEC is complaining about.
>
> Thanks!!
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
