Monitoring logs on the Wazuh server

[fernando vargas]

Hello,

I would like to monitor a specific log file on my wazuh server. Something like /home/user/events.log.

How can I do the configuration?

Thanks in advance.

[Mariano Koremblum]

Hi!

I would recommend you reading the following links:

• https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/log-data-configuration.html
• https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/localfile.html

In this case, you should set up a localfile configuration block like the following one:

<localfile>
    <location>/var/log/messages</location>
    <log_format>syslog</log_format>
</localfile>

This is for standard syslog logs, in case it has another format, please take a look to the following link:

• https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/localfile.html#log-format

Best regards,

Mariano Koremblum

​

[fernando vargas]

Thanks Mariano

[Mariano Koremblum]

Hi,

Sorry, just saw that I forgot to change the location to the one that you specified. It would be like this:

<localfile>
    <location>/home/user/events.log</location>
    <log_format>syslog</log_format>
</localfile>

Best regards,

Mariano Koremblum

​