0

I want ossec server to send alerts to Syslog server. Now in this case Ossec Server and RSyslog Server are on same server.

I want Ossec Server to send all the alerts from client to location /var/log/Clients_Logs/127.0.0.1/ossec.log . I updated ossec.conf file like this.

<syslog_output>
    <server>127.0.0.1</server>
    <location>/var/log/Clients_Logs/127.0.0.1/ossec.log</location>
    <port>514</port>
    <level>3</level>
</syslog_output>

And when i tried to restart ossec server . It slapped me with this error

ossec-monitord not running ..
ossec-logcollector not running ..
ossec-remoted not running ..
ossec-syscheckd not running ..
ossec-analysisd not running ..
ossec-maild not running ..
ossec-execd not running ..
ossec-csyslogd not running ..
OSSEC HIDS v2.8 Stopped
Starting OSSEC HIDS v2.8 (by Trend Micro Inc.)...
2015/11/30 17:13:02 ossec-csyslogd: DEBUG: Starting ...
2015/11/30 17:13:02 ossec-config(1230): ERROR: Invalid element in the configuration: 'location'.
2015/11/30 17:13:02 ossec-config(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting.
2015/11/30 17:13:02 ossec-csyslogd(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting.
ossec-csyslogd did not start correctly.

I read man pages on ossec site but it didn't help . Any suggestions .......

0

The syslog output option will send syslog messages to a syslog server (rsyslog in your case). It is up to the receiver to determine where the log message should go. Remove the location option and you shouldn't get the error any longer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.