syslog %%OSSEC_HOME%%/logs/active-responses.log syslog /var/ossec/logs/active-responses.log