syslog日志转换器_图解将windows日志转成syslog格式并发送

ossim支持

如果想用再ossim上，需要修改

process=rsyslogd

start=no ; launch plugin process when agent starts

stop=no ; shutdown plugin process when agent stops

startup=/etc/init.d/rsyslog start

shutdown=/etc/init.d/rsyslog stop

source=log

location=/var/log/snare.log

create_file=true

再到

alienvault:/etc/ossim# cat /etc/rsyslog.d/snare.conf

if $msg contains '192.168.1.8' then -/var/log/snare.log

if $rawmsg contains 'EventLog' then -/var/log/snare.log

~

之后重启ossim-agent和rsyslog服务就可以了。