[ossec-list] RE : [ossec-list] Re: Localfiles on Server ?

["Fred" <fcr-mailings@xxxxxxxxx>]

Hi Daniel (and other ones !),

Well, problem is that log file to check exists.

OSSEC Agent correctly parses first log file entry, with "%Y-%m-%d", but not
second one:

	Error parsing file: '/var/log/httpd/access_[...].%Y-%m-%d'

It seems that Agent doesn't replace "%Y-%m-%d" by values for second entry.

Thanks very much.

Fred

-----Original Message-----
From: ossec-list@xxxxxxxxxxxxxxxx [mailto:ossec-list@xxxxxxxxxxxxxxxx] On
Behalf Of Daniel Cid
Sent: Wednesday, June 28, 2006 4:01 AM
To: ossec-list@xxxxxxxxx
Subject: [ossec-list] Re: Localfiles on Server ?


Hi Fred,

We will fix this problem for the next release. Ossec should not fail if
there is
no local file to be read. However, for now, just create a dummy file entry
on
the config or remove  ossec-logcollector from the init script.

Hope it helps...

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 6/26/06, Fred <fcr-mailings@xxxxxxxxx> wrote:
>
>
> Hi everyone,
>
> First, congratulations to Daniel and Development Team for its 2nd rank on
> IDS Tools !
>
> I have a question: I would like that Server does not check "Localfiles",
> i.e. itself. However, if I remove all "localfile" options in Server conf,
I
> cannot start it anymore:
>
> ---------------------
>
>     Starting OSSEC HIDS v0.8 (by Daniel B. Cid)...
>     2006/06/26 10:44:46 ossec-logcollector(1905): No file configured to
> monitor.
>     ossec-logcollector: Configuration error. Exiting
>
> ---------------------
>
> I can do a dummy localfile, but I would prefer something cleaner ;-)
>
> Thanks in advance.
>
> Fred
>
>
>
>  >
>



--~--~---------~--~----~------------~-------~--~----~
-~----------~----~----~----~------~----~------~--~---