ossec.conf: Syslog Output options¶

Overview¶

<ossec_config>
    <syslog_output>
        <!--
        Syslog Output options here
        -->
    </syslog_output>
</ossec_config>

Options¶

• syslog_output

  • server

    • IP Address of the syslog server.
    • Allowed: any valid IP address

  • port

    • Port to forward alerts to.
    • Default 514
    • Allowed: Any valid port

  • level

    • Minimum alert level of the alerts to be forwarded.
    • Allowed: 1 - 16

  • group

    • Alerts belonging to this group will be forwarded.
    • Allowed: Any valid group. Separate multiple groups with the pipe (|) character.
    • Examples:

    <group>syscheck</group>
    <group>authentication_failure|authentication_success</group>
    

  • rule_id

    • Alerts matching this rule_id will be forwarded.
    • Allowed: Any valid rule_id

  • location

    • Alerts from this location will be forwarded.
    • Allowed: Any valid logfile location

  • use_fqdn

    New in version 2.9.0.

    • By default, ossec truncates the hostname at the first period (‘.’) when generating syslog messages. Setting this option to ‘yes’ will cause it to use the full hostname configured on the server.
    • Default no
    • Allowed yes, no

  • format

    • Format of alert output. The default format is “default”, or full syslog output.
    • CEF is the ArcSight Common Event Format.
    • json can be used with a variety of tools.
    • The splunk option is for sending data to a Splunk server.
    • Allowed default, cef, splunk, json
    • Example:

    <syslog_output>
              <server>10.0.0.1</server>
              <port>514</port>
              <format>cef</format>
    </syslog_output>