Atomicorp

As a follow up to this post for anyone that might run into a similar problem. My issue turned out to be missing the line that the wildcard only supports files that exist on startup. The example documentation didn't reference this particular info however some older version documentation configuration...

I have 2 servers with ossec-hids-agent and identical configuration files. OS - CentOS release 6.10 (Final) OSSEC Version - OSSEC HIDS v3.6.0 - OSSEC Foundation In the local server ossec-agent.conf. I added a custom localfile entry for tomcat log files that rotate frequently and use a down to the sec...