Generating alerts from ossec ( server- agent ) model
- by batman
I'm very new to OSSEC. I use a server-agent model. I wish to generate alert for the following actions ( in agent side ):
1) Sample Alert for delation of logs
I added the rules for these in agent's ossec.conf using <localfile> tags. Like this :
<localfile>
<log_format>syslog</log_format>
<location>/var/log/syslog</location>
</localfile>
In my server's ossec.conf. I added the following :
<global>
<email_notification>yes</email_notification>
<email_to>xxxx@xxxxxx</email_to>
<smtp_server>smtp.gmail.com</smtp_server>
<email_from>xxxx@xxx</email_from>
</global>
And I restarted my server. Now I tried to delete the agents syslog file using rm syslog. But no alerts has been triggered.
Where I'm making the mistake?
