[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ossec-list] Problem with log_format named

To: ossec-list@xxxxxxxxx
Subject: [ossec-list] Problem with log_format named
From: "Valerio Daelli" <valerio.daelli@xxxxxxxxx>
Date: Mon, 17 Sep 2007 10:46:04 +0200
Authentication-results: mx.google.com; spf=pass smtp.mail=ossec-list+caf_=ossec-list=googlegroups.com@xxxxxxxxx; dkim=pass (test mode) header.i=@xxxxxxxxx
Authentication-results: mx.google.com; spf=pass (google.com: domain of valerio.daelli@xxxxxxxxx designates 209.85.198.187 as permitted sender) smtp.mail=valerio.daelli@xxxxxxxxx; dkim=pass (test mode) header.i=@xxxxxxxxx
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=1v/NzMpKTNqEkEEJhRyoACuDpX9A/Sdj+aOVuIcbsnE=; b=VsBTK2LP8wzSduoEbPRKfurPmynCTgn1aB7bmOkVVNZ0wiXu2uLG51/JhDrDGCCrDGNZK9pWSi9dzGXUQ1W5lq9rnzoyV3NyToTlfa6lFfnGuwGZ6Py/azLBuaovwueBHivqSCWNMA9fW3OjAP6cEP0QyTufCgFeXx1Ans8DV90=

Hi
we use ossec-hids 1.3 on FreeBSD and we would like to monitor
the logs of BIND.
If we use a log_format of 'named' the server cannot even start.
If we use a log_format of syslog for the log file of named we get tons
of false positives.
Is it possible on ossec-hids 1.3 to monitor the logs of named?
Which log_format should we use?
Thanks a lot

Valerio Daelli

Follow-Ups:
- [ossec-list] Re: Problem with log_format named
  - From: Daniel Cid

Prev by Date: [ossec-list] Re: Granular Email Options
Next by Date: [ossec-list] Re: Problem with a cisco 837 router
Previous by thread: [ossec-list] Re: Ignore clients logs from the server
Next by thread: [ossec-list] Re: Problem with log_format named
Index(es):
- Date
- Thread

OSSEC home | Main Index | Thread Index

OSSEC project: www.ossec.net.
Mailling list information: http://www.ossec.net/en/mailing_lists.html.