analyze existing syslog store

[Jake Peltz]

We are interested in exploring Wazuh's but are already collecting syslogs on a Redhat server. Would we place an agent on that server and use the onssec.conf file localfile section to have Wazuh monitor our existing log file directories? 

thanks

[Henadence Anyam]

Hello Jake,

Thank you for using Wazuh.

Wazuh is able to send and receive messages via Syslog. Syslog allows machines where the Wazuh agent cannot be installed to report events. 

Since you already have a syslog client installed, you can just configure the Wazuh server to receive syslog messages. 

Follow this guide to configure your Wazuh server to receive syslog events. Ensure that your configuration matches that of the syslog client.

Another case is to install the Wazuh agent which automatically collects syslog events out of the box without further configuration.

Let me know if that helps.

Best regards.

[Jake Peltz]

Instead of sending syslogs to Wazuh we're trying to leverage our existing system that collects syslogs from all our devices and stores them in plaintext files. From the guide link you sent it looks like the 'Storing syslog logs in a plaintext file and monitoring it with Wazuh' feature may be an option. Is that correct?

thanks    

[Henadence Anyam]

That is correct.

In that case, install the Wazuh agent and edit the /var/ossec/etc/ossec.conf configuration file to point to the log location as shown in the guide.

Then restart the Wazuh service.

Best regards.