Hi,
I am trying to use a symlink for local_rules.xml. Here is what I did
cd /var/ossec/rules
cp local_rules.xml /opt/ossec/rules
mv local_rules.xml local_rules.xml.bak
ln -s /opt/ossec/rules/local_rules.xml local_rules.xml
But I couln't start OSSEC after this change and when I check the log file
.
>
> In some scenarios, when really necessary, what we do is remount a
> partition inside the jail (mount -o bind). I don't recommend this, but it
> is a workaround that should work.
>
> Best
>
> On Tue, Feb 16, 2016 at 2:45 PM, Rui Zhang > wrote:
>
>> Hi,
k that your
> ossec.conf is configured to look for the rules where you want. As well,
> symbolic links inside the jail should work.
>
> I hope that helps
>
> On Wed, Feb 17, 2016 at 7:49 AM, Rui Zhang > wrote:
>
>> Thank you, Santiago! Other than remounting a partit
