My problem is that I have some windows programs I want to monitor with the following structure in the logs filename:

Program name%Y%m%d_%timestamp.log

Where %timestamp is formed by the concatenation of hours, minutes, seconds and milliseconds. I've already been reading the documentation about the OSSEC agent and performing some tests, and any of them where successful.

As the manual says at the localfile section:

Wildcards may be used on non-Windows systems

So I don't know how to monitor these logs folders. Can anyone help me, please?


I don't want to monitor the file sizes or movements. I want to get the events contained in those logs and process them.


It looks like you're looking at the log collector element rather than at the file integrity monitoring element which is covered by in the documentation: https://ossec-docs.readthedocs.io/en/latest/manual/syscheck/

Rather than looking at specific files, you could monitor the directory. You know the directory will increase in size and items will be deleted based on retention periods and automated jobs. Once you know these metrics, you'll be able to monitor for specific changes which may be suspicious or malicious.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.