XML section name
This section shows how to configure the format of the internal log file (“ossec.log”).
Specifies the log format between JSON output (.json) or plain text (.log). It also can be set to output both formats at the same time, when both are formats are entered, separated by a comma.
Depending on the given format, the output file will be
/var/ossec/logs/ossec.json or both of them.
<!-- Choose between plain or json format (or both) for internal log file --> <logging> <log_format>plain</log_format> </logging>