[Ossec-list] Local logs on agents ?

[daniel.cid at gmail.com (Daniel Cid)]

Hi Fred,

Unfortunately, the agents do not keep their logs locally. There is no
"simple" way to do this right now (unless changing the code). I will
try to add this for the next version, but I can't guarantee. Just to
make sure I understand your problem, you want the agents to
keep the logs until the server is reachable again? And then
start forwarding from that point?

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net
http://www.ossec.net

On 4/12/06, Fred <fcr-mailings at nerim.net> wrote:
> Hello,
>
> My OSSEC agents correctly send events to OSSEC servers, but never log in
> local (i.e. in /var/ossec/logs).
>
> Is it normal ? Is there a way to do this ?
>
> I think it's important, in case if OSSEC server would be unreachable.
>
> Thanks.
>
> Fred
>
> _______________________________________________
> ossec-list mailing list
> ossec-list at ossec.net
> http://mailman.underlinux.com.br/mailman/listinfo/ossec-list
>