Forward OSSEC logs to a Syslog Server

[Saket]

Hi,

I am trying to forward the OSSEC logs to a syslog server.

I know it stores the logs in /ossec/logs/ossec.log file and
/ossec/logs/alerts/alerts.log

But, is there a way to send these logs to a syslog server?

Thanks,
Saket

[dan (ddp)]

The alerts can be forwarded using the client syslog functionality in ossec.

[Jeremy Lee]

Seems you can forward alerts to a syslog server:
http://www.ossec.net/dcid/?p=139

Not sure about the actual ossec.log entries.

[Saket]

This is what I was looking for.

Can you tell me where to find
<syslog_output>
<server>192.168.4.1</server>
</syslog_output>

<syslog_output>
<level>10</level>
<server>10.1.1.1</server>
</syslog_output>

I looked up ossec.conf , should I include it there?

Thanks,
Saket

On Dec 29, 3:42 pm, Jeremy Lee <jpl...@gmail.com> wrote:
> Seems you can forward alerts to a syslog server:http://www.ossec.net/dcid/?p=139
>
> Not sure about the actual ossec.log entries.
>

[dan (ddp)]

Hi Saket,

On Wed, Dec 29, 2010 at 6:23 PM, Saket <saketb...@gmail.com> wrote:
> This is what I was looking for.
>
> Can you tell me where to find
>    <syslog_output>
>    <server>192.168.4.1</server>
>    </syslog_output>
>
>    <syslog_output>
>    <level>10</level>
>    <server>10.1.1.1</server>
>    </syslog_output>
>
> I looked up ossec.conf , should I include it there?
>
> Thanks,
> Saket
>

Yes, this configuration belongs in the ossec.conf on the manager.