Ok I'll do that. Also, not sure if you know but thought I'd ask anyway...Is there anyway to use the agents name in a rule or decoder? I have my agents named after the hostname so I was thinking that could potentially be another option. Don't see anything about it in the documentation however.
On Thursday, April 6, 2017 at 10:16:49 AM UTC-7, dan (ddpbsd) wrote: > > On Wed, Apr 5, 2017 at 11:13 AM, Jake B. <cspit...@gmail.com <javascript:>> > wrote: > > I'm not server if this is a problem with the OSSEC configuration or the > host > > itself, but there are some events where the logs or full message only > have > > some of the information I need. For example, this will be the full > message I > > receive (2016-02-03 14:16:35 status installed some_package). The email > alert > > will give me the agent name it sent it from, but I am not receiving the > > hostname as well. It seems to be that most events do give the full > message, > > but I'm starting to notice some that don't so wondering if I should be > > looking to fix this on the OSSEC side or making sure the system is fully > > logging or sending everything over. Thanks! > > > > All of my test systems are down due to weather at the moment, but > check the agent's logs to see if the hostname is included. > If the hostname isn't included in the log, there's no way for OSSEC to add > it. > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to ossec-list+...@googlegroups.com <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
