This is the documentation for Wazuh 3.9. Check out the docs for the latest version of Wazuh!

logging

XML section name

<logging>
</logging>

This section shows how to configure the format of the internal log file (“ossec.log”).

Options

log_format

Specifies the log format between JSON output (.json) or plain text (.log). It also can be set to output both formats at the same time, when both are formats are entered, separated by a comma.

Depending on the given format, the output file will be /var/ossec/logs/ossec.log, /var/ossec/logs/ossec.json or both of them.

Default value plain
Allowed values
  • plain
  • json
  • plain, json

Default configuration

<!-- Choose between plain or json format (or both) for internal log file -->
<logging>
  <log_format>plain</log_format>
</logging>