<!--
  Command output read through Logcollector.
  <log_format>command</log_format> treats each output line as its own log
  entry; <log_format>full_command</log_format> treats the whole output as one.

  Gate: an agent ignores command and full_command sources that arrive through
  the centralized agent.conf unless logcollector.remote_commands=1 is set in
  /var/ossec/etc/local_internal_options.conf on that endpoint. The gate does
  not apply to command sources written directly into the agent's own
  ossec.conf.

  Reference:
  https://documentation.wazuh.com/5.0-beta/user-manual/reference/ossec-conf/localfile.html
-->

<!-- One line per file system. Collected by default on Linux agents. -->
<localfile>
  <log_format>command</log_format>
  <command>df -P</command>
  <frequency>360</frequency>
</localfile>

<!-- Whole output as a single entry, renamed in the event so a decoder can
     match on a stable name rather than on the command string. -->
<localfile>
  <log_format>full_command</log_format>
  <command>netstat -tulpn</command>
  <alias>listening-sockets</alias>
  <frequency>600</frequency>
</localfile>

<!-- Recent logins. -->
<localfile>
  <log_format>full_command</log_format>
  <command>last -n 20</command>
  <alias>recent-logins</alias>
  <frequency>3600</frequency>
</localfile>
