How can I Configure ossec to watch the active response.log file will fire an alert? Why active-responses.log is not writing?
In agent: <localfile> <log_format>syslog</log_format> <location>/var/ossec/logs/active-responses.log</location> </localfile> -bash-3.2# ls -l /var/ossec/logs total 86 -rw-r--r-- 1 root root 0 Oct 17 14:30 active-responses.log -rw-rw-r-- 1 ossec ossec 44032 Oct 17 14:29 ossec.log in the server: -bash-3.2# ls -l /var/ossec/logs total 7432 -rw-rw---- 1 ossec ossec 0 May 19 10:01 active-responses.log drwxr-x--- 3 ossec ossec 4096 Oct 17 12:56 alerts drwxr-x--- 3 ossec ossec 4096 Oct 17 12:56 archives drwxr-x--- 3 ossec ossec 4096 Oct 17 12:56 firewall -rw-rw---- 1 ossec ossec 7582818 Oct 17 17:09 ossec.log -----Mensaje original----- De: ossec-list@googlegroups.com [mailto:ossec-list@googlegroups.com] En nombre de dan (ddp) Enviado el: miércoles, 19 de octubre de 2016 07:50 a.m. Para: ossec-list@googlegroups.com Asunto: Re: [ossec-list] Active response On Wed, Oct 19, 2016 at 8:43 AM, dan (ddp) <ddp...@gmail.com> wrote: > On Tue, Oct 18, 2016 at 6:54 PM, Aj Navarro <ajnavarro1...@gmail.com> wrote: >> Only I see the next messages in /var/ossec/logs/alers/alerts.log >> >> ** Alert 1476724188.107242: mail - syslog,errors, >> >> 2016 Oct 17 12:09:48 ixtrtc42scf->/var/log/messages >> >> Rule: 1002 (level 2) -> 'Unknown problem somewhere in the system.' >> >> Oct 17 12:09:48 ixtrtc42scf kernel: type=1100 >> audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 >> ses=4294967295 msg= >> >> 'op=PAM:authentication acct="root" exe="/usr/sbin/sshd" >> hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh res=failed' >> > > These log messages are not triggering 5712. In fact OSSEC isn't sure > what to do with these log messages. > Is there anything in your auth log? > Digging into it further, we get: # cat /tmp/yy | /var/ossec/bin/ossec-logtest -q 2016/10/19 08:44:09 ossec-testrule: INFO: Reading the lists file: 'rules/lists/ossec.block' 2016/10/19 08:44:09 ossec-testrule: INFO: Started (pid: 16098). ossec-testrule: Type one log per line. **Phase 1: Completed pre-decoding. full event: 'Oct 17 12:09:48 ixtrtc42scf kernel: type=1100 audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh res=failed'' hostname: 'ixtrtc42scf' program_name: 'kernel' log: 'type=1100 audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh res=failed'' **Phase 2: Completed decoding. decoder: 'iptables' **Phase 3: Completed filtering (rules). Rule id: '1002' Level: '2' Description: 'Unknown problem somewhere in the system.' **Alert to be generated. So we'll have to create a decoder to deal with these odd log messages. Adding the following decoder to my local decoders file: <decoder name="wtf-iptables"> <parent>iptables</parent> <prematch> exe="/usr/sbin/sshd" </prematch> <!--<regex> acct="(\S+)" hostname="(\S+)" addr="(\S+)" </regex>--> <regex> acct="(\S+)" exe="/\.+/sshd" hostname=(\S+) addr=(\S+) </regex> <order>user,dstip, srcip</order> </decoder> I get: **Phase 1: Completed pre-decoding. full event: 'Oct 17 12:09:48 ixtrtc42scf kernel: type=1100 audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh res=failed'' hostname: 'ixtrtc42scf' program_name: 'kernel' log: 'type=1100 audit(1476724188.016:36149378): user pid=6141 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=10.188.62.176 addr=10.188.62.176 terminal=ssh res=failed'' **Phase 2: Completed decoding. decoder: 'iptables' dstuser: 'root' dstip: '10.188.62.176' srcip: '10.188.62.176' **Phase 3: Completed filtering (rules). Rule id: '1002' Level: '2' Description: 'Unknown problem somewhere in the system.' **Alert to be generated. I haven't done any testing to see if this will affect anything else though. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
