Yes,
If you can show us a few log samples from racoon (failed logins, sucessful logins and anything else you may have), we can help you with that :) -- Daniel B. Cid dcid ( at ) ossec.net On 8/10/06, kef_list <[EMAIL PROTECTED]> wrote:
Yeah, that would be a need step, but I would also need to add info to the decode.xml file, as well as a rules file, right? I was wondering if anyone was working on this. On Aug 10, 2006, at 16:39 , <[EMAIL PROTECTED]> <[EMAIL PROTECTED]> wrote: > > > I suppose you must add the following lines to the ossec.conf > > <localfile> > <log_format>racoon</log_format> > <location>/var/log/racoon.log</location> > </localfile> > > Ruurd Bakker > Network engineer > SECQuard.nl > ____________________________________________________ Institut Balear de Comunicacions, S.L. Gremio Tejedores 22, 1 07009 Palma de Mallorca, Spain Tel: +34 971.45.90.99 | Mobile: +34 607.87.12.77 Fax: +34 971.43.08.18 | E-mail: [EMAIL PROTECTED] URL: http://www.ibacom.es/ ____________________________________________________
