Worst advice?
That must have been that time my boss asked me how to restart rsyslog (Windowsguy and I was on vacation)
- "just do rm -r /var/log haha"
And ONE SECOND LATER I SENT THIS
- "haha jk dont"
Waiting a minute and I get this:
- "well that did not work"

Damnit

Over 3 months, I wrestled and toiled with learning how rsyslog works, send to the log server, passes that to AlienVault OSSIM, where I have to build a plugin that, I thought could be done with a built-in plugin builder but ended up with building it from scratch, and have to learn Regex (surprisingly was fun thanks to amazing online resources), test, build, restart rsyslog, ossim-agent, ossim-server and ossim-db just to get the application log showing up on the BROWSER!

I like OSSIM but what's killing me the most is rsyslog. I still can't get grasp how to get custom logs of any kind into a log server. I don't think I'll remember any of this by tomorrow but whelp.