Advice-- Receiver for OSSEC via Syslog #36417
rphung-cloudwave
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Greetings--
I've attempted to create a receiver for OSSEC messages from an ossec-control server by enabling a syslog forwarder:
from ossec.conf
Then on my agent config.yaml:
I get something like---
Failed to process entry","kind":"receiver","name":"syslog","data_type":"logs","operator_id":"syslog_input_internal_parser","operator_type":"syslog_parser","error":"parsed value was not rfc3164 or rfc5424 compliant"
Clearly, OSSEC isn't rfc-compliant.
I've tried something like:
and although it looks like it's listening, I'm not getting any events.
Any help is appreciated.
Beta Was this translation helpful? Give feedback.
All reactions