You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
And what i get in ossec.log is:
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'all'.
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'su'.
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'NetworkManager'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'all'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'su'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'NetworkManager'.
Doesn't the implementation allows ossec to read directly from the output of the journalctl or do i have to create a new file and add it to the location label.
Also i have the logall option set to yes in order to see if the logs of the journald are being monitored and none of the logs i find there are from the journald.
Any help?
The text was updated successfully, but these errors were encountered:
I am triying to read the output of journalctl so i have added this lines in the ossec.conf file:
(just copied the following commit):
4d01278
And what i get in ossec.log is:
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'all'.
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'su'.
2024/05/13 12:35:12 ossec-logcollector(1951): INFO: Analyzing journald log: 'NetworkManager'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'all'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'su'.
2024/05/13 12:37:22 ossec-logcollector(1904): INFO: File not available, ignoring it: 'NetworkManager'.
Doesn't the implementation allows ossec to read directly from the output of the journalctl or do i have to create a new file and add it to the location label.
Also i have the logall option set to yes in order to see if the logs of the journald are being monitored and none of the logs i find there are from the journald.
Any help?
The text was updated successfully, but these errors were encountered: