Search found 2 matches
- Tue Aug 31, 2021 6:59 pm
- Forum: OSSEC
- Topic: OSSEC Agent Seems to Stop Parsing and/or reporting localfile entry
- Replies: 1
- Views: 15847
Re: OSSEC Agent Seems to Stop Parsing and/or reporting localfile entry
As a follow up to this post for anyone that might run into a similar problem. My issue turned out to be missing the line that the wildcard only supports files that exist on startup. The example documentation didn't reference this particular info however some older version documentation configuration...
- Fri May 14, 2021 7:32 pm
- Forum: OSSEC
- Topic: OSSEC Agent Seems to Stop Parsing and/or reporting localfile entry
- Replies: 1
- Views: 15847
OSSEC Agent Seems to Stop Parsing and/or reporting localfile entry
I have 2 servers with ossec-hids-agent and identical configuration files. OS - CentOS release 6.10 (Final) OSSEC Version - OSSEC HIDS v3.6.0 - OSSEC Foundation In the local server ossec-agent.conf. I added a custom localfile entry for tomcat log files that rotate frequently and use a down to the sec...