My first guess is the file is being rotated or changed in some way. Anything that you know of that might be doing this? I don't believe OSSEC (at least the Windows side) saves the last read position but I could be wrong on that. I can say with confidence that it will save the last known positions for event logs though.
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
