Forwarding Linux syslogs to syslog server

[700...@gmail.com]

Hi, 

I am new to the OSSEC. I am confused about forwarding logs.

Does OSSEC client collects logs from /var/log/messages  and forwards them to the ossec server /var/log/messages?   Or should be log forwarding configured in  rsyslog on Red Hat to forward all logs to rsyslog server?

Thx in advance

Regards

 V

[dan (ddp)]

OSSEC does not write to /var/log/messages. It can store all logs it
receives in /var/ossec/logs/archive/archives.log, if you turn on the
logall feature.
But if you want a syslog backup of log messages, you'll have to
configure your syslogd to do it for you.

> Thx in advance
>
> Regards
>
>
> V
>

> --
>
> ---
> You received this message because you are subscribed to the Google Groups "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[700 grm]

Thank you for your prompt response.

1. How can I turn on logall feature on ossec client?

2. it mean that OSSEC client can collect all system logs from /var/log/   forward them to a OSSEC server and store them in  /var/ossec/logs/archive/archives.log ?

Thx in advance

V

[dan (ddp)]

On Fri, Nov 9, 2018 at 11:21 AM 700 grm <700...@gmail.com> wrote:
>
> Thank you for your prompt response.
>
> 1. How can I turn on logall feature on ossec client?
>

It's a server side setting, not a client side.
http://www.ossec.net/docs/syntax/head_ossec_config.global.html?highlight=logall#element-logall

> 2. it mean that OSSEC client can collect all system logs from /var/log/ forward them to a OSSEC server and store them in /var/ossec/logs/archive/archives.log ?
>

Correct. Anything the agent sends to the server will be logged in the
archives log.

[700 grm]

In situation can we install OSSEC Server and syslog backup server on the same machine?

Or it will create a lot of issues: double alerts   > it will analyse same var/log/messages on client and server side?

thx in advance

[dan (ddp)]

On Fri, Nov 9, 2018 at 12:14 PM 700 grm <700...@gmail.com> wrote:
>
> In situation can we install OSSEC Server and syslog backup server on the same machine?
> Or it will create a lot of issues: double alerts > it will analyse same var/log/messages on client and server side?
>

If OSSEC monitors the file syslogd saves the remote log messages to,
you'll get doubled up alerts.
If you want to do both on the same machine, you'll want to save the
messages to files that OSSEC isn't monitoring.

[700 grm]

Thank you for explanation, everything is clear and working as expected