Wildcard not work for monitor files

[Jérémy]

Hi,

I have logs in the directory: "D:\Applications\Tomcat\apache-tomcat-8.5.34\logs"

I added this configuration in ossec.conf :

  <localfile>

    <location>D:\Applications\Tomcat\apache-tomcat-8.5.34\logs\*</location>

    <log_format>syslog</log_format>

  </localfile>

then restarted the agent but I have the following error in the logs:

2019/10/22 15:27:20 ossec-agent: ERROR: (1103): Could not open file 'D:\Applications\Tomcat\apache-tomcat-8.5.34\logs\*.txt' due to [(123)-(The filename, directory name, or volume label syntax is incorrect.)].

When I put a full path like "D:\Applications\Tomcat\apache-tomcat-8.5.34\logs\localhost_access_log.2019-10-22.txt" it works

Thanks

Jérémy

[Miguel Keane]

Hello Jeremy, 

Depending on your logs there you have to use different types of wildcards. Here you can see more use cases: https://documentation.wazuh.com/3.10/user-manual/reference/ossec-conf/localfile.html#location

In this case, the correct path would be something like: 

<location>D:\Applications\Tomcat\apache-tomcat-8.5.34\logs\localhost_access_log-%Y-%m-%d.txt</location>

I hope this works for you, bur if does not or if you have any other questions, do not hesitate to contact us again and we will help you. 

Regards, 

Miguel Keane

[Jérémy]

Hi, 

thank you for your answer.

we are in version 3.8.2, moreover, we have logs where there is no date how can we do it?

Thanks

[Miguel Keane]

Hello Jeremy, 

I have been looking closely into your issue and it seem as it is a bug that we fixed in 3.9: 

https://github.com/wazuh/wazuh/pull/2929

I would strongly recommend upgrading to 3.10 to solve your issue. 

But if you don't want to, you can have a look specifically to the changes that solved the Wildcard on Windows here: https://github.com/wazuh/wazuh/pull/2910/files

Though this option will probably be a bit more difficult. 

Please, let me know if you manage to fix your issue and feel free to ask us any questions. 

Best regards, 

Miguel Keane 

[Miguel Keane]

Hello Jeremy, 

 Were you able to update your system? I would just like to point out that it wasn't a bug as I said, wildcards in Windows were not supported in Wazuh until 3.9 version, that is why you couldn't make them work.  
I hope you managed to solve this issue.

Regards

Miguel Keane