Oh thank Dan... the question 1. because when the server dectect attack from agent the only server know that. i think agent need know that. Can you help me more details. ( sorry my english is bad :( 2. i have turn on option <logall>yes</logall> but have error
Vào 23:43:15 UTC+7 Thứ hai, ngày 26 tháng năm năm 2014, dan (ddpbsd) đã viết: > > > On May 26, 2014 12:39 PM, "Nguyễn Văn Hớn" <hon...@gmail.com <javascript:>> > wrote: > > > > hi everybody. i have question : > > How to send alert from server to agent when agent have attacked. And log > from agent send to server. Where is it stored? > > > > You can't really send the alerts to the agents. You can send some alerts > to a centralized location uskng csyslogd, but there's no functionality to > send it to a lot of locations. Why would you want to do this anyways? > Alerts are stored in /var/ossec/logs/alerts. Log messages are not stored > by default, you need to turn on the log all option. If yiu do that they're > stored in logs/archives. > > > thank for help > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an email to ossec-list+...@googlegroups.com <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
