Just verified neither Windows or *NIX will store file positions of the files they are reading. When OSSEC's logcollector starts up and begins processing files it is configured for it will just seek to the end so yes, things can be missed if something happens while OSSEC is reading the file. Again, event logs and event channel will save their positions on the Windows side which might be a better option for you. Not sure why it is messing up reading your file though.
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
