[Ossec-list] RE : Local logs on agents ?

[fcr-mailings at nerim.net (Fred)]

Hi Daniel,

Thanks for your answer.

That's exactly what I would like: that agents keep logs until server be
reachable again.

In my case, server is on another site than agents, and link between agents
and server is a VPN over Internet.

Thank you.

Fred


-----Original Message-----
From: Daniel Cid [mailto:daniel.cid at gmail.com] 
Sent: Thursday, April 13, 2006 2:59 AM
To: Fred
Cc: ossec-list at ossec.net
Subject: Re: [Ossec-list] Local logs on agents ?


Hi Fred,

Unfortunately, the agents do not keep their logs locally. There is no
"simple" way to do this right now (unless changing the code). I will
try to add this for the next version, but I can't guarantee. Just to
make sure I understand your problem, you want the agents to
keep the logs until the server is reachable again? And then
start forwarding from that point?

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net
http://www.ossec.net

On 4/12/06, Fred <fcr-mailings at nerim.net> wrote:
> Hello,
>
> My OSSEC agents correctly send events to OSSEC servers, but never log in
> local (i.e. in /var/ossec/logs).
>
> Is it normal ? Is there a way to do this ?
>
> I think it's important, in case if OSSEC server would be unreachable.
>
> Thanks.
>
> Fred
>
> _______________________________________________
> ossec-list mailing list
> ossec-list at ossec.net
> http://mailman.underlinux.com.br/mailman/listinfo/ossec-list
>