On Thu, Apr 6, 2017 at 1:46 PM, dan (ddp) <ddp...@gmail.com> wrote: > On Thu, Apr 6, 2017 at 1:29 PM, Jake B. <cspitr....@gmail.com> wrote: >> Ok I'll do that. Also, not sure if you know but thought I'd ask anyway...Is >> there anyway to use the agents name in a rule or decoder? I have my agents >> named after the hostname so I was thinking that could potentially be another >> option. Don't see anything about it in the documentation however. >> > > It's either hostname or location, but I can never remember which. > >> On Thursday, April 6, 2017 at 10:16:49 AM UTC-7, dan (ddpbsd) wrote: >>> >>> On Wed, Apr 5, 2017 at 11:13 AM, Jake B. <cspit...@gmail.com> wrote: >>> > I'm not server if this is a problem with the OSSEC configuration or the >>> > host >>> > itself, but there are some events where the logs or full message only >>> > have >>> > some of the information I need. For example, this will be the full >>> > message I >>> > receive (2016-02-03 14:16:35 status installed some_package). The email >>> > alert >>> > will give me the agent name it sent it from, but I am not receiving the >>> > hostname as well. It seems to be that most events do give the full >>> > message, >>> > but I'm starting to notice some that don't so wondering if I should be >>> > looking to fix this on the OSSEC side or making sure the system is fully >>> > logging or sending everything over. Thanks! >>> > >>> >>> All of my test systems are down due to weather at the moment, but >>> check the agent's logs to see if the hostname is included. >>> If the hostname isn't included in the log, there's no way for OSSEC to add >>> it. >>>
Here's an example from my dpkg.log: 2017-03-04 13:24:22 status installed man-db:amd64 2.6.7.1-1ubuntu1 No hostname in the log message. >>> > -- >>> > >>> > --- >>> > You received this message because you are subscribed to the Google >>> > Groups >>> > "ossec-list" group. >>> > To unsubscribe from this group and stop receiving emails from it, send >>> > an >>> > email to ossec-list+...@googlegroups.com. >>> > For more options, visit https://groups.google.com/d/optout. >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to ossec-list+unsubscr...@googlegroups.com. >> For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
