Yes, I can see when I changed the hostname, ossec will pick the new one. Is it possible to use the full domain name? For e.g www.example.com, not just use www, instead I want it to show full domain name, i.e www.example.com
Regards
Louis
Daniel Cid <dcid@xxxxxxxxx> wrote:
Hi Louis,
As soon as you change the hostname and your logs starts to report the new one (you may just need to restart syslog), ossec will use them too. Also, you can setup ossec in the base system and replicate anywhere you want, and ossec will not store the initial hostname.
To change the e-mail from address, you just edit the option "email_from" on ossec.conf
Hope it
helps,
-- Daniel B. Cid dcid ( at ) ossec.net
On 3/23/07, Louis Voo wrote: > Hi Daniel, > > Thanks for the reply. > > Yes, I know Ossec use the hostname from the log generated and it same as my > /etc/hostname. But my problem is it store the hostname into the log after > installed. If I change the /etc/hostname, it won't get automatically change. > > I'm setting up a base system, then duplicate it to many. To cut down the > customisation, I hope I can just change the /etc/hostname, and the rest will > also get changed. > > I open the maild.h, I can see it using %s, but I don't know how to change it > to the equivalent command 'hostname -f', and if possible I also want to > change the mail from ossecm@, so that when I change my > hostname, I don't need to reconfigure ossec.conf. > > Hope you can help me out on
this. > > Thanks > Louis > > > Daniel Cid wrote: > > Hi Louis, > > Ossec by default will use the hostname that was present in the log generated > (which for the local install should be equal to /etc/hostname). What are you > getting right now? You can easily modify it by changing src/os_maild/maild.h > if you want. > > hope it helps. > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > > On 3/22/07, Louis Voo wrote: > > Hello, > > > > I'm new to OSSEC. It took me lot of time to find out swatch replacement, > and > > OSSEC is so easy to setup. > > > > I have setup OSSEC as local running on my server. Now anything happen it > > will send mail to me. I wonder whether I can change the mail subject or > not. > > I want to change the subject to
use the HOSTNAME dynamically from > > /etc/hostname, is this possible? > > > > Regards > > Louis > >