I realize this is an old thread, but I have been struggling to get this to work on 2008 R2 (64 bit) for weeks. I finally discovered that Microsoft has changed the way system32 works, in that it no longer permits access by 32 bit applications. That access is redirected to c:\windows\sysnative which is hidden in explorer. So, on 64 bit windows, I believe from Vista on, the proper syntax for the location is: <location>%windir%\sysnative\Dhcp\DhcpSrvLog-%a.log</location> This work just fine for the daily rotation as well.
Scott On Tuesday, October 23, 2012 2:34:47 PM UTC-5, Brian Sims wrote: > > I see there is an MS DHCP parser, but I'm not having much success in > getting it to work in a stable fashion. The log file names are > DhcpSrvLog-Sun.log, DhcpSrvLog-Mon.log, etc and so rotate on a weekly basis > - the naming convention is not configurable. > > The first agent config sample my google-fu turned up the following > <ossec_config> > <localfile> > <location>%windir%\system32\dhcp\*.log</location> > <log_format>syslog</log_format> > </localfile> > </ossec_config> > > That did not work as MS logs can't be wildcarded. I then added the > individual log files: > > <localfile> > <location>%windir%\system32\dhcp\Audit\DhcpSrvLog-Sun.log</location> > <log_format>syslog</log_format> > </localfile> > <localfile> > <location>%windir%\system32\dhcp\Audit\DhcpSrvLog-Mon.log</location> > <log_format>syslog</log_format> > </localfile> > <localfile> > <location>%windir%\system32\dhcp\Audit\DhcpSrvLog-Tue.log</location> > <log_format>syslog</log_format> > </localfile> > <localfile> > <location>%windir%\system32\dhcp\Audit\DhcpSrvLog-Wed.log</location> > <log_format>syslog</log_format> > </localfile> > <localfile> > <location>%windir%\system32\dhcp\Audit\DhcpSrvLog-Thu.log</location> > <log_format>syslog</log_format> > </localfile> > <localfile> > <location>%windir%\system32\dhcp\Audit\DhcpSrvLog-Fri.log</location> > <log_format>syslog</log_format> > </localfile> > <localfile> > <location>%windir%\system32\dhcp\Audit\DhcpSrvLog-Sat.log</location> > <log_format>syslog</log_format> > </localfile> > > This seemed to work at first... but it doesn't seem to handle the rotation > and dies when the next log day up is rotated. That's the current log - > and so the important one. This occurs shortly after the nightly rotation: > > 2012/10/19 00:02:07 ossec-agent(1117): ERROR: Error handling file > 'C:\WINDOWS\system32\dhcp\Audit\DhcpSrvLog-Fri.log' (date). > 2012/10/19 00:02:07 ossec-agent(1103): ERROR: Unable to open file > 'C:\WINDOWS\system32\dhcp\Audit\DhcpSrvLog-Fri.log'. > 2012/10/19 00:06:36 ossec-agent(1904): INFO: File not available, ignoring > it: 'C:\WINDOWS\system32\dhcp\Audit\DhcpSrvLog-Fri.log'. > > OSSEC seems to handle other log rotation gracefully, so not sure why this > is problematic. Given there's a bundled MS DHCP parser, it'd seem that > someone must have gotten this successfully working... > > TIA, > Brian > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.