Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Monitoring logs of journald not working #2122

Open
bntuser opened this issue May 13, 2024 · 0 comments
Open

Monitoring logs of journald not working #2122

bntuser opened this issue May 13, 2024 · 0 comments

Comments

@bntuser
Copy link

bntuser commented May 13, 2024

I am triying to read the output of journalctl so i have added this lines in the ossec.conf file:

<localfile>
    <log_format>journald</log_format>
    <location>all</location>
  </localfile>

  <localfile>
    <log_format>journald</log_format>
    <location>su</location>
  </localfile>

  <localfile>
    <log_format>journald</log_format>
    <location>NetworkManager</location>
  </localfile>

(just copied the following commit):
4d01278

And what i get in ossec.log is:
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'all'.
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'su'.
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'NetworkManager'.

2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'all'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'su'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'NetworkManager'.

Doesn't the implementation allows ossec to read directly from the output of the journalctl or do i have to create a new file and add it to the location label.

Also i have the logall option set to yes in order to see if the logs of the journald are being monitored and none of the logs i find there are from the journald.

Any help?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant