I'm very new to OSSEC. I use a server-agent model. I wish to generate alert for the following actions ( in agent side ):
1) Sample Alert for delation of logs
I added the rules for these in agent's
<localfile> tags. Like this :
<localfile> <log_format>syslog</log_format> <location>/var/log/syslog</location> </localfile>
In my server's ossec.conf. I added the following :
<global> <email_notification>yes</email_notification> <email_to>xxxx@xxxxxx</email_to> <smtp_server>smtp.gmail.com</smtp_server> <email_from>xxxx@xxx</email_from> </global>
And I restarted my server. Now I tried to delete the agents syslog file using
rm syslog. But no alerts has been triggered.
Where I'm making the mistake?