[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-list
Subject:    [Ossec-list] FIFO files and Agent/Server updates
From:       daniel.cid () gmail ! com (Daniel Cid)
Date:       2006-05-23 14:26:33
Message-ID: b92e6f200605230726l2692a318u20d3168458d57139 () mail ! gmail ! com
[Download RAW message or body]

Hi Fred,

What are the names used on your apache logs? Ossec supports the specification
of dates in the localfile option.

For example, if you log is /var/log/www/apache_year_month_day.log
(for today being /var/log/www/apache_2006_May_22.log), the localfile
option would be:

<localfile>/var/log/www/apache_%y_%m_%d.log</localfile>

For other options, look at the strftime manual:
http://www.die.net/doc/linux/man/man3/strftime.3.html

Hope it helps. If not, we will need to do some changes to support
FIFO...

Thanks,

--
Daniel B. Cid
dcid @ ( at ) ossec.net

On 5/23/06, Fred <fcr-mailings at nerim.net> wrote:
>
>
> Hello everybody,
>
> I would have a question on OSSEC.
>
> 1) First is that I have a problem with Apache logs. As we use "logrotate"
> for rotation, log files names are always different, including the current
> one. A solution would be to use a FIFO file: Apache logs would be copied in
> FIFO files.
> So my questions are:
>
>     - can OSSEC Agent may read FIFO files (localfile directive) ?
>     - are there any risks that Apache may block in case of problem with FIFO
> ?
>
> Thanks a lot.
>
> Regards,
>
> Fred
>
> _______________________________________________
> ossec-list mailing list
> ossec-list at ossec.net
> http://mailman.underlinux.com.br/mailman/listinfo/ossec-list
>
>
>

[prev in list] [next in list] [prev in thread] [next in thread]