mah1952 I have this for the webserver logs:
/var/local/enhance/webserver_logs/*.log
No matter what webserver you're using, the directory and the log formats are the same.
And these for mail:
#Postfix
filenames:
- /var/local/enhance/email/data/logs/postfix/postfix.log
labels:
type: syslog
---
#dovecot
filenames:
- /var/local/enhance/email/data/logs/dovecot/dovecot.log
labels:
type: dovecot
---
Webserver logs have a special format for Enhance, so you'll need to create a parser for that.
I shared something here in case you want try it out.
https://community.enhance.com/d/1072-custom-crowdsec-webserver-access-log-detection-for-enhance
Please take into consideration the need to create a whitelist for some cases. I've had some issues with some /filerd addresses that I had to take care of.
