On Mon, Sep 15, 2014 at 10:56 AM, BP9906 <[email protected]> wrote: > I keep seeing this repeatedly in OSSEC server's ossec.log. How do I see who > this is coming from? >
Isn't it coming from the system that's reporting it? I think ossec-logcollector only does local log collection. If not, look at adding something to src/logcollector/read_multiline.c or src/logcollector/read_syslog.c, depending on which one is more appropriate. If it is the local system, you can probably add some debug messages in there to figure out which log file is causing the issue. > 2014/09/15 07:51:48 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:51:50 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:51:52 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:51:54 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:51:56 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:51:58 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:00 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:02 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:04 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:06 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:08 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:10 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:12 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:14 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:16 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:18 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:20 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:22 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:24 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:26 ossec-logcollector: Message not complete. Trying again: > '' > 2014/09/15 07:52:28 ossec-logcollector: Message not complete. Trying again: > '' > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
