Howdy, I've had a lot of luck with OSSEC and it's helped immensely to monitor Windows systems, but I've run into a problem trying to capture certain event logs from Windows systems.
The event is Windows event 6005, Initialization of audit logs. I believe the problem is this event is happening before the OSSEC Agent is started by Windows, but I'm not even sure how to check if that's true. I have no problems collecting other events from the System event log, but that one never seems to come through. Is there any way for OSSEC To grab historical Windows event logs or am I approaching this incorrectly? Thanks -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
