[ossec-list] cannot get policy auditing to work

[Keith Goodlip]

I've been trying to setup policy audit in a lab I've set up to no avail.

My setup is 2 servers (server, client) using CentOS 7.3 and RPMs from the 
atomic repository (selinux, firewalld are disabled) (ipv6 is enabled)

All server processes are up and running:

*[root@ossec-server ossec]# bin/ossec-control status*
*ossec-monitord is running...*
*ossec-logcollector is running...*
*ossec-remoted is running...*
*ossec-syscheckd is running...*
*ossec-analysisd is running...*
*ossec-maild is running...*
*ossec-execd is running...*
*ossec-dbd is running...*


client enrolled via manage_agents and I can see it registered and active:

*[root@ossec-server ossec]# bin/agent_control -i 001*
*OSSEC HIDS agent_control. Agent information:*
*   Agent ID:   001*
*   Agent Name: ossec-client.infosec*
*   IP address: 172.16.29.6/32*
*   Status:     Active*

*   Operating system:    Linux ossec-client.infosec 
3.10.0-514.10.2.el7.x86_64 #1 SMP Fri Mar 3 00:04:05 UTC 2017 x86_64*
*   Client version:      OSSEC HIDS v2.9.0 / 
9fd969bbe7f4a3f52951a3e3acb1953b*
*   Last keep alive:     Tue Mar 28 23:09:30 2017*

*   Syscheck last started  at: Tue Mar 28 23:00:35 2017*
*   Rootcheck last started at: Tue Mar 28 22:41:41 2017*


here is my agent.conf:
<agent_config os="Linux">
  <syscheck>
    <!-- Frequency that syscheck is executed - default to every 22 hours -->
    <frequency>3600</frequency>

    <!-- Directories to check  (perform all possible verifications) -->
    <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
    <directories check_all="yes">/bin,/sbin</directories>

    <!-- Files/directories to ignore -->
    <ignore>/etc/mtab</ignore>
    <ignore>/etc/mnttab</ignore>
    <ignore>/etc/hosts.deny</ignore>
    <ignore>/etc/mail/statistics</ignore>
    <ignore>/etc/random-seed</ignore>
    <ignore>/etc/adjtime</ignore>
    <ignore>/etc/httpd/logs</ignore>
    <ignore>/etc/utmpx</ignore>
    <ignore>/etc/wtmpx</ignore>
    <ignore>/etc/cups/certs</ignore>
    <ignore>/etc/dumpdates</ignore>
    <ignore>/etc/svc/volatile</ignore>

  </syscheck>

  <!-- Files to monitor (localfiles) -->
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/messages</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/secure</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/maillog</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/log/yum.log</location>
  </localfile>

  <localfile>
    <log_format>syslog</log_format>
    <location>/var/ossec/logs/active-responses.log</location>
  </localfile>

  <rootcheck>
    <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
    
<rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
    <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
    
<system_audit>/var/ossec/etc/shared/cis_rhel7_linux_rcl.txt</system_audit>
  </rootcheck>

</agent_config>

MD5 matches between /var/ossec/etc/shared/agent.conf and the client version 
I get from *bin/agent_control -i 001*

However I'm not getting any results from the  system_audit.

What am I doing wrong? 

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.