When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|
I'm not certain it will automatically, as its core purpose is real-time alerting and active response. In saying that, you can run manual log analysis on any log file. The instructions at http://www.ossec.net/main/manual/manual-log-analysis give guidance on configuring log analysis. You just need to provide the name of the file to be monitored and the format. |
|||
|
|
