I have the following stanzas in my config:
<ossec_config>
<global>
<email_notification>yes</email_notification>
<email_to>s...@xxxxx.com</email_to>
<smtp_server>mail.XXXXX.com.</smtp_server>
<email_from>oss...@ossec.xxxxx.com</email_from>
</global>
# Database section here
<reports>
<category>syscheck</category>
<title>Daily report: File changes</title>
<email_to>s...@xxxxx.com</email_to>
<email_to>m...@xxxxx.com</email_to>
</reports>
I am getting OSSEC Notification emails now but no reports so I am a little
confused.
Thanks,
Sean
On Tue, Jul 11, 2017 at 11:28 AM, Rocio Romero <ro...@wazuh.com> wrote:
> Hi Sean,
>
> Have you configured the global email options in the <global> section?
>
> You should have something like this:
>
> <ossec_config>
> <global>
> <email_notification>yes</email_notification>
> <email_to>m...@test.com</email_to>
> <smtp_server>mail.test.com.</smtp_server>
> <email_from>he...@test.com</email_from>
> </global>
> ...
> </ossec_config>
>
>
> In case you want to use an email that uses SMTP authentication you will
> need to configure a server relay
> <https://documentation.wazuh.com/current/user-manual/manager/output-options/manual-email-report/smtp_authentication.html#smtp-authentication>
> .
>
> You can find more info about how to configure your manager to send email
> alerts or reports here
> <https://documentation.wazuh.com/current/user-manual/manager/output-options/manual-email-report/smtp_authentication.html#smtp-authentication>
> .
>
> Let me know if you have more questions!
>
> Rocio
>
>
>
> On Tuesday, July 11, 2017 at 8:53:37 AM UTC-7, Sean Roe wrote:
>>
>> Hi all,
>>
>> I am trying to troubleshoot why I am not getting any daily reports and Im
>> not really sure how to troubleshoot it. I have looked in the logs and I
>> see entries like:
>>
>> 2017/07/11 00:01:34 ossec-monitord: INFO: Starting daily reporting for
>> 'Daily report: File changes'
>> 2017/07/11 00:01:54 ossec-monitord: INFO: Starting daily reporting for
>> 'Daily report: File changes'
>>
>>
>> but I am not getting any output in my email. Here is the stanza from
>> ossec.conf on the server:
>>
>> <reports>
>> <category>syscheck</category>
>> <title>Daily report: File changes</title>
>> <email_to>s...@xxxxx.com</email_to>
>> <email_to>m...@xxxxx.com</email_to>
>> </reports>
>>
>> so any guidance would be helpful.
>>
>> Thanks,
>> Sean
>>
>>
>> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
