{"id":19788334,"url":"https://github.com/graylog2/graylog-guide-ossec","last_synced_at":"2026-03-05T10:31:28.203Z","repository":{"id":137547631,"uuid":"66175598","full_name":"Graylog2/graylog-guide-ossec","owner":"Graylog2","description":"How to write OSSEC alerts into Graylog","archived":false,"fork":false,"pushed_at":"2016-08-21T01:22:47.000Z","size":4,"stargazers_count":12,"open_issues_count":2,"forks_count":3,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-02-28T14:39:18.237Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Graylog2.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-08-21T01:22:38.000Z","updated_at":"2024-09-27T18:07:24.000Z","dependencies_parsed_at":null,"dependency_job_id":"f683cf9c-6a61-465a-9628-2b8b15064e3d","html_url":"https://github.com/Graylog2/graylog-guide-ossec","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Graylog2/graylog-guide-ossec","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ossec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ossec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ossec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ossec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Graylog2","download_url":"https://codeload.github.com/Graylog2/graylog-guide-ossec/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ossec/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30119427,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T09:35:22.236Z","status":"ssl_error","status_checked_at":"2026-03-05T09:35:20.028Z","response_time":93,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T06:26:54.013Z","updated_at":"2026-03-05T10:31:28.174Z","avatar_url":"https://github.com/Graylog2.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# How to send OSSEC alerts into Graylog\n\nThis guide describes how to send structured OSSEC alert logs into Graylog.\n\n![](https://s3.amazonaws.com/graylog2public/ossec_integration/dashboard.png)\n\n## Configuring Graylog\n\n### Installing the CEF input plugin\n\nWe’ll use the CEF format to forward logs from OSSEC to Graylog. There is an official Graylog plugin to read OSSEC logs via TCP or UDP and you can get it here:\n\n* [Graylog CEF message input](https://github.com/Graylog2/graylog-plugin-cef)\n\nFollow the installation instructions in the linked repository.\n\n### Setting up a CEF input \n\nAfter installing the CEF input plugin and restarting `graylog-server`, go to `System -\u003e Inputs` in your Graylog Web Interface and start a new **CEF UDP Input**.\n\nRemember the port you configure it to listen on. We’ll need it in the next step.\n  \n## Configuring OSSEC\n\nAfter starting the CEF UDP input in the previous step, open your OSSEC configuration file (usually located at `/var/ossec/etc/ossec.conf`) and add the following to the global `\u003cossec_config\u003e` path:\n\n    \u003csyslog_output\u003e\n        \u003cserver\u003egraylog.example.org\u003c/server\u003e\n        \u003cport\u003e12000\u003c/port\u003e\n        \u003cformat\u003ecef\u003c/format\u003e\n    \u003c/syslog_output\u003e\n\nMake sure to configure the same port you have your Graylog UDP CEF input listen on.\n\nYou also need to enable the OSSEC syslog subsystem on most operating systems. On Linux, execute this command:\n\n    /var/ossec/bin/ossec-control enable client-syslog\n\nRestart OSSEC and see if messages arrive.\n\n    /var/ossec/bin/ossec-control restart\n\n## Result\n\nNow all OSSEC alerts should arrive in Graylog with nicely parsed and extracted fields:\n\n![](https://s3.amazonaws.com/graylog2public/ossec_integration/message.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgraylog2%2Fgraylog-guide-ossec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgraylog2%2Fgraylog-guide-ossec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgraylog2%2Fgraylog-guide-ossec/lists"}