Home / server / Questions / 380196
In Process
Nikolaidis Fotis
Asked: 2012-04-18 04:22:23 +0800 CST

Ossec fields to Oracle DB

  • 772

I would like some recommendations for the following problem. I use Ossec for log analysis. What I want, is after extracting the fields to save them in an Oracle database.

For example, if I have this line

IP:(\d+.\d+.\d+.\d+)@(\w+): (forcefield \w+); (.*)

I want $1 go to Ip tables, $2 to host, $3 to msg ... etc

For the moment I am considering to execute a script when I have a match, but I looking for a better approach if possible.

cheers

logging ossec

1 Answers

  1. I'm not sure how this is possible within ossec, but you can do it with nxlog (disclaimer: I'm affiliated with the project). It can write the fields to database using the om_dbi module.

    • 1