On 25.09.2012 10:00, dan (ddp) wrote:
Because you offered to modify the source code to implement the feature, and I thought you would get it. It was a failed attempt at a humorous way of answering the question.
That's nothing. I was about to suggest an ossec command that kept cat'ing /dev/null into the alerts.log.
I wouldn't turn off alerts.log, though. Databases crash, lock, don't get restarted, etc. It's much less reliable than flat files, IMHO. Maybe just delete the archived logs after a certain period of time...
