[ossec-list] Re: vsftpd rule

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

That is correct. For each file that you want to monitor, you need to have a
localfile entry.

Thanks,

--
Daniel B. Cid
dcid @ ( at ) ossec.net

On 6/6/06, Kayvan A. Sylvan <kayvan@xxxxxxxxxx> wrote:
>
> How do we do that? (configure ossec to read /var/log/vsftpd.log)?
>
> In etc/ossec.conf, I see lines like this:
>
>   <localfile>
>     <log_format>syslog</log_format>
>     <location>/var/log/messages</location>
>   </localfile>
>
> So, do I just add nother snippet like this?
>
>   <localfile>
>     <log_format>syslog</log_format>
>     <location>/var/log/vsftpd.log</location>
>   </localfile>
>
> --
> Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
> Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89)
> http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)
>
> >
>

--~--~---------~--~----~------------~-------~--~----~
-~----------~----~----~----~------~----~------~--~---