This is an interesting problem. The client does not really have become a syslog server, it simply needs to be able to trap logging and forward them to the OSSEC server which in turn will have to know how to dispose off such messages.
I will appreciate any posts with possible solutions to this type of general problem.
Cheers,
Rama Kant
On 4/13/07, Pankaj P. Pawar < Pankajpa@xxxxxxxxxx> wrote:
>
> ***********************
> Your mail has been scanned by InterScan.
> ***********-***********
>
>
>
>
>
> Hi All,
>
>
>
> Is it possible that my Ossec Client acts as a Syslog Server and forwards all these events to the mail server which is configured on my Ossec Server??
>
> How can I create a decoder for the same?
>
>
>
> Thanks,
>
> Pankaj P.
>
>
> ***********************************************************************************
> This message is for the named addressees' use only. It may contain NSDL
>
> confidential, proprietary or legally privileged information. If you receive
>
> this message in error, please immediately delete it. You must not, directly
>
> or indirectly, use, disclose, distribute, print, or copy any part of this message
>
> if you are not the intended recipient.Unless otherwise stated, any commercial
>
> information given in this message does not constitute an offer to deal on
>
> any terms quoted. Any reference to the terms of executed transactions
>
> should be treated as preliminary only and subject to our formal written
>
> confirmation.
> ***********************************************************************************
>