Advice-- Receiver for OSSEC via Syslog #36417
rphung-cloudwave
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Greetings--
I've attempted to create a receiver for OSSEC messages from an ossec-control server by enabling a syslog forwarder:
from ossec.conf
Then on my agent config.yaml:
I get something like---
Failed to process entry","kind":"receiver","name":"syslog","data_type":"logs","operator_id":"syslog_input_internal_parser","operator_type":"syslog_parser","error":"parsed value was not rfc3164 or rfc5424 compliant"
Clearly, OSSEC isn't rfc-compliant.
I've tried something like:
and although it looks like it's listening, I'm not getting any events.
Any help is appreciated.
Beta Was this translation helpful? Give feedback.
All reactions