On Sun, Aug 18, 2013 at 11:23 PM, dan (ddp) <[email protected]> wrote: > > On Aug 18, 2013 11:21 PM, "Jacob Seeley" <[email protected]> wrote: >> >> Hello, >> >> I am experiencing this same issue with version 2.7. >> >> Is anyone aware of a solution? >> >> Thanks, >> >> > > I'm pretty sure it doesn't work. I think it's documented, but I'm not sure > that version of the docs is public yet. >
It is documented: http://ossec.net/doc/syntax/head_ossec_config.localfile.html#element-location >> On Sunday, November 8, 2009 6:28:54 PM UTC-5, Nik Keating wrote: >>> >>> Hello, >>> >>> I've been experiencing some errors when using combinations of regular >>> expressions and strftime strings in location declarations and was >>> wondering if there was a known work around or if this usage is just not >>> supported. I am using v2.2 on a Linux system. >>> >>> It appears location definitions that utilize both strftime and regex >>> consistently result in "ERROR: Glob error. Invalid pattern" message. >>> >>> As an example: >>> >>> <localfile> >>> <log_format>apache</log_format> >>> <location>/var/log/HOSTS/web*/20091108/access_log</location> >>> </localfile> >>> >>> works correctly, as does: >>> >>> <localfile> >>> <log_format>apache</log_format> >>> <location>/var/log/HOSTS/web01/%Y%m%d/access_log</location> >>> </localfile> >>> >>> but the combination: >>> >>> <localfile> >>> <log_format>apache</log_format> >>> <location>/var/log/HOSTS/web*/%Y%m%d/access_log</location> >>> </localfile> >>> >>> Results in: >>> >>> Starting OSSEC: 2009/11/08 15:06:03 ossec-config(1121): ERROR: Glob >>> error. Invalid pattern: '/var/log/HOSTS/web*/%Y%m%d/access_log'. >>> 2009/11/08 15:06:03 ossec-config(1121): ERROR: Glob error. Invalid >>> pattern: '/var/log/HOSTS/web*/%Y%m%d/access_log'. >>> >>> Thanks for the help! >>> -Nik >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
