I've been trying to setup policy audit in a lab I've set up to no avail. My setup is 2 servers (server, client) using CentOS 7.3 and RPMs from the atomic repository (selinux, firewalld are disabled) (ipv6 is enabled)
All server processes are up and running: *[root@ossec-server ossec]# bin/ossec-control status* *ossec-monitord is running...* *ossec-logcollector is running...* *ossec-remoted is running...* *ossec-syscheckd is running...* *ossec-analysisd is running...* *ossec-maild is running...* *ossec-execd is running...* *ossec-dbd is running...* client enrolled via manage_agents and I can see it registered and active: *[root@ossec-server ossec]# bin/agent_control -i 001* *OSSEC HIDS agent_control. Agent information:* * Agent ID: 001* * Agent Name: ossec-client.infosec* * IP address: 172.16.29.6/32* * Status: Active* * Operating system: Linux ossec-client.infosec 3.10.0-514.10.2.el7.x86_64 #1 SMP Fri Mar 3 00:04:05 UTC 2017 x86_64* * Client version: OSSEC HIDS v2.9.0 / 9fd969bbe7f4a3f52951a3e3acb1953b* * Last keep alive: Tue Mar 28 23:09:30 2017* * Syscheck last started at: Tue Mar 28 23:00:35 2017* * Rootcheck last started at: Tue Mar 28 22:41:41 2017* here is my agent.conf: <agent_config os="Linux"> <syscheck> <!-- Frequency that syscheck is executed - default to every 22 hours --> <frequency>3600</frequency> <!-- Directories to check (perform all possible verifications) --> <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> <directories check_all="yes">/bin,/sbin</directories> <!-- Files/directories to ignore --> <ignore>/etc/mtab</ignore> <ignore>/etc/mnttab</ignore> <ignore>/etc/hosts.deny</ignore> <ignore>/etc/mail/statistics</ignore> <ignore>/etc/random-seed</ignore> <ignore>/etc/adjtime</ignore> <ignore>/etc/httpd/logs</ignore> <ignore>/etc/utmpx</ignore> <ignore>/etc/wtmpx</ignore> <ignore>/etc/cups/certs</ignore> <ignore>/etc/dumpdates</ignore> <ignore>/etc/svc/volatile</ignore> </syscheck> <!-- Files to monitor (localfiles) --> <localfile> <log_format>syslog</log_format> <location>/var/log/messages</location> </localfile> <localfile> <log_format>syslog</log_format> <location>/var/log/secure</location> </localfile> <localfile> <log_format>syslog</log_format> <location>/var/log/maillog</location> </localfile> <localfile> <log_format>syslog</log_format> <location>/var/log/yum.log</location> </localfile> <localfile> <log_format>syslog</log_format> <location>/var/ossec/logs/active-responses.log</location> </localfile> <rootcheck> <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files> <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans> <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit> <system_audit>/var/ossec/etc/shared/cis_rhel7_linux_rcl.txt</system_audit> </rootcheck> </agent_config> MD5 matches between /var/ossec/etc/shared/agent.conf and the client version I get from *bin/agent_control -i 001* However I'm not getting any results from the system_audit. What am I doing wrong? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.