Lamp server and Apache logs

[Sardar Sadaqat]

Hi Wes and Doug sir

I try to get access and error logs of lamp and Apache server I try different methods I define rules in ossec but still am unable to get logs path are correct I verify all settings should I need some additional settings means I need to define rule in snort as well I just want to ship access and error logs of both these server kindly guide me 

[Wes Lambert]

Hi Sardar,

You haven't mentioned how you've attempted to ship/monitor these logs (specific configuration/files).  If you could please provide more detail around that, we may be able to better assist you with your issue.

Thanks,

Wes

On Wed, Jul 10, 2019, 12:01 PM Sardar Sadaqat <sardarsa...@gmail.com> wrote:

Hi Wes and Doug sir

I try to get access and error logs of lamp and Apache server I try different methods I define rules in ossec but still am unable to get logs path are correct I verify all settings should I need some additional settings means I need to define rule in snort as well I just want to ship access and error logs of both these server kindly guide me 

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
To view this discussion on the web visit https://groups.google.com/d/msgid/security-onion/CA%2Biqiknwq%3DbBH%3DbboV7vFvce_RKE2QC3Y2etqwm%2BgXicjjz1Vw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[Sardar Sadaqat]

for lamp server access logs

<localfile>
<log_format>apache</log_format>
<location>/opt/lampp/logs/access_log</location>
</location>

For lamp server error logs
<localfile>
<log_format>apache</log_format>
<location>/opt/lampp/logs/error_log</location>
</location>

i also try to change the log format

<log_format>syslog</log_format>

but still unable to get the desired results path are same as i mentioned here  

To view this discussion on the web visit https://groups.google.com/d/msgid/security-onion/CAHjBB6Ea2W%2BoR9j5o61U9dpH9forWN8MzZnZuq%2BmBRW%2BqHVtHA%40mail.gmail.com.

[Wes Lambert]

Have you double-checked the log paths?

Thanks,

Wes

To view this discussion on the web visit https://groups.google.com/d/msgid/security-onion/CA%2Biqik%3DsUyheHk74Oy_Y%3DmXSiDgLBsQujvsDPk35DD6wZ%2BbFWA%40mail.gmail.com.

[Sardar Sadaqat]

Hi Wes and Doug 

[Sardar Sadaqat]

Yes I do 

To view this discussion on the web visit https://groups.google.com/d/msgid/security-onion/CAHjBB6GCZtEKLXVORF1R2j3atK%2BsYWBFegixrkN6XDRZEJ2-jw%40mail.gmail.com.