Re: [ossec-list] OSSEC Log Retention

2018-11-28 Thread dan (ddp)
On Wed, Nov 28, 2018 at 9:44 AM Andrew Thomas  wrote:
>
>
> In the documentation, regarding logs, it says:
>
> How long are they stored?
>
> For as long as your policy dictates (it is user configurable).
>
> But I don't see a configuration option for this, and reading other posts, 
> some people have alluded to keeping them for 13 months for PCI Compliance, 
> and others have said OSSEC doesn't delete files.
>
> So, how do I go about storing logs for 12 months?
>

I'm not entirely sure what that documentation is really supposed to
mean. OSSEC doesn't delete logs, it'll keep them as long as you want.
Removing logs is up to you.

>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups 
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to ossec-list+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


[ossec-list] OSSEC Log Retention

2018-11-28 Thread Andrew Thomas

In the documentation, regarding logs, it says:

How long are they stored?
   
   - For as long as your policy dictates (it is user configurable).

But I don't see a configuration option for this, and reading other posts, 
some people have alluded to keeping them for 13 months for PCI Compliance, 
and others have said OSSEC doesn't delete files.

So, how do I go about storing logs for 12 months?


-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.