I see, I'll try same_location then as I believe that should serve my purpose as well. Thanks!
On Thursday, April 6, 2017 at 10:49:16 AM UTC-7, dan (ddpbsd) wrote: > > On Thu, Apr 6, 2017 at 1:46 PM, dan (ddp) <ddp...@gmail.com <javascript:>> > wrote: > > On Thu, Apr 6, 2017 at 1:29 PM, Jake B. <cspit...@gmail.com > <javascript:>> wrote: > >> Ok I'll do that. Also, not sure if you know but thought I'd ask > anyway...Is > >> there anyway to use the agents name in a rule or decoder? I have my > agents > >> named after the hostname so I was thinking that could potentially be > another > >> option. Don't see anything about it in the documentation however. > >> > > > > It's either hostname or location, but I can never remember which. > > > >> On Thursday, April 6, 2017 at 10:16:49 AM UTC-7, dan (ddpbsd) wrote: > >>> > >>> On Wed, Apr 5, 2017 at 11:13 AM, Jake B. <cspit...@gmail.com> wrote: > >>> > I'm not server if this is a problem with the OSSEC configuration or > the > >>> > host > >>> > itself, but there are some events where the logs or full message > only > >>> > have > >>> > some of the information I need. For example, this will be the full > >>> > message I > >>> > receive (2016-02-03 14:16:35 status installed some_package). The > email > >>> > alert > >>> > will give me the agent name it sent it from, but I am not receiving > the > >>> > hostname as well. It seems to be that most events do give the full > >>> > message, > >>> > but I'm starting to notice some that don't so wondering if I should > be > >>> > looking to fix this on the OSSEC side or making sure the system is > fully > >>> > logging or sending everything over. Thanks! > >>> > > >>> > >>> All of my test systems are down due to weather at the moment, but > >>> check the agent's logs to see if the hostname is included. > >>> If the hostname isn't included in the log, there's no way for OSSEC to > add > >>> it. > >>> > > Here's an example from my dpkg.log: > 2017-03-04 13:24:22 status installed man-db:amd64 2.6.7.1-1ubuntu1 > > No hostname in the log message. > > >>> > -- > >>> > > >>> > --- > >>> > You received this message because you are subscribed to the Google > >>> > Groups > >>> > "ossec-list" group. > >>> > To unsubscribe from this group and stop receiving emails from it, > send > >>> > an > >>> > email to ossec-list+...@googlegroups.com. > >>> > For more options, visit https://groups.google.com/d/optout. > >> > >> -- > >> > >> --- > >> You received this message because you are subscribed to the Google > Groups > >> "ossec-list" group. > >> To unsubscribe from this group and stop receiving emails from it, send > an > >> email to ossec-list+...@googlegroups.com <javascript:>. > >> For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
