2

I would like some recommendations for the following problem. I use Ossec for log analysis. What I want, is after extracting the fields to save them in an Oracle database.

For example, if I have this line

IP:(\d+.\d+.\d+.\d+)@(\w+): (forcefield \w+); (.*)

I want $1 go to Ip tables, $2 to host, $3 to msg ... etc

For the moment I am considering to execute a script when I have a match, but I looking for a better approach if possible.

cheers

Nikolaidis Fotis
  • 1,994
  • 11
  • 13

1 Answers1

1

I'm not sure how this is possible within ossec, but you can do it with nxlog (disclaimer: I'm affiliated with the project). It can write the fields to database using the om_dbi module.

b0ti
  • 986
  • 1
  • 6
  • 13