Configuring syslog output
Wazuh may be configured to send alerts to syslog as follows:
Configuration
Syslog output is configured in the ossec.conf
file. All of the available options are detailed in Syslog output.
<ossec_config>
<syslog_output>
<level>9</level>
<server>192.168.1.241</server>
</syslog_output>
<syslog_output>
<server>192.168.1.240</server>
</syslog_output>
</ossec_config>
The above configuration will send alerts to 192.168.1.240
and, if the alert level is higher than 9, also to 192.168.1.241
.
After the configuration of the ossec.conf
file, the client-syslog must be enabled, followed by a restart of Wazuh using the following command:
# /var/ossec/bin/ossec-control enable client-syslog
For Systemd:
# systemctl restart wazuh-manager
For SysV Init:
# service wazuh-manager restart