Regding OSSEC

vamsi_k · **Posted:** Fri May 04, 2012 5:50 am

FYI...

Installed OSSEC server version 2.6 in Cent OS 6.2 and agents are web servers

installed in chroot environment.

In ossec.conf file, added below configuration in both server and agent.

<localfile>
<log_format>syslog</log_format>
<location>/chroot/site/usr/local/apache/logs/error_log</location>
</localfile>

Already in decoder.xml and in rules folder apache related configuration is set

by default.

Problem : Ossec is not working for apache logs, not even generating

mails related to Apache errors , rest of the ossec part is working as needed.

Please guide me what has to be done to solve the issue.

scott · **Posted:** Fri May 04, 2012 2:57 pm

Oh easy one there, you've got the wrong log type specified. Change that from "syslog" to "apache"

vamsi_k · **Posted:** Sat May 05, 2012 2:02 pm

Even i tried the same , but didn't get the required output.

FYI...
Moreover ossec server and apache (web servers are agents) are installed in separate machines.

scott · **Posted:** Mon May 07, 2012 9:33 am

Not sure whats going on there then, thats definitely the right syntax though. We use it all over the place.

vamsi_k · **Posted:** Mon May 07, 2012 11:55 pm

Can you please tell me what has to cross checked to make it work as required.

scott · **Posted:** Tue May 08, 2012 10:18 am

Sure, here is an example:

Code:

  <localfile>
    <log_format>apache</log_format>
    <location>/var/log/httpd/access_log</location>
  </localfile>

Regding OSSEC

Who is online