From ba0ea32ad0c74cb7fbe6ede683aea697a68fbfd9 Mon Sep 17 00:00:00 2001
From: Lukas Kuap <l.kaup@jochheim-edv.de>
Date: Mon, 26 Jan 2026 09:33:04 +0000
Subject: [PATCH] KWG/Server/UBNT/KWG-NXCloud/ossec.conf aktualisiert

---
 KWG/Server/UBNT/KWG-NXCloud/ossec.conf | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/KWG/Server/UBNT/KWG-NXCloud/ossec.conf b/KWG/Server/UBNT/KWG-NXCloud/ossec.conf
index ae66065..6a86a39 100644
--- a/KWG/Server/UBNT/KWG-NXCloud/ossec.conf
+++ b/KWG/Server/UBNT/KWG-NXCloud/ossec.conf
@@ -117,6 +117,8 @@
     <directories check_all="yes">/etc/ssh</directories>
     <directories check_all="yes">/etc/cups</directories>
     <directories check_all="yes">/var/spool/cups</directories>
+    <directories check_all="yes" realtime="yes">/var/snap/nextcloud/current/nextcloud/config</directories>
+    <directories check_all="yes" realtime="no">/var/snap/nextcloud/current/nextcloud/apps</directories>
 
     <!-- Files/directories to ignore -->
     <ignore>/etc/mtab</ignore>
@@ -197,6 +199,21 @@
     <location>journald</location>
   </localfile>
 
+  <localfile>
+  <log_format>json</log_format>
+  <location>/var/snap/nextcloud/current/logs/nextcloud.log</location>
+</localfile>
+
+<localfile>
+  <log_format>apache</log_format>
+  <location>/var/snap/nextcloud/current/logs/apache.log</location>
+</localfile>
+
+<localfile>
+  <log_format>syslog</log_format>
+  <location>/var/snap/nextcloud/current/logs/php-fpm.log</location>
+</localfile>
+
   <localfile>
     <log_format>syslog</log_format>
     <location>/var/log/auth.log</location>