Hi all,
Since upgrading my (Solaris) ossec-hids server to version 1.4 I'm now seeing the problem of the dying "maild" process. Never seen this problem before. I'm currently running a "truss" (Solaris equivalent of strace) on the process to see what, if anything, shows up. Cheers, Richard --On 29 November 2007 21:06 -0400 Daniel Cid <[EMAIL PROTECTED]> wrote: > > Hi Pierre, > > Thanks for the information. I was able to find out where the bug is > and the fix is available at: > > http://www.ossec.net/files/snapshots/ossec-hids-071129.tar.gz > > > Just update to this new version and the problem should go away. > > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > On Nov 29, 2007 8:55 AM, Pierre Boisvert <[EMAIL PROTECTED]> wrote: >> >> Hi Daniel, >> >> Here the information you are requesting: >> >> >> Result of the strace: >> >> read(4, "", 4096) = 0 >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout) >> read(4, "", 4096) = 0 >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout) >> read(4, "", 4096) = 0 >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout) >> read(4, "", 4096) = 0 >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout) >> read(4, "", 4096) = 0 >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout) >> read(4, "", 4096) = 0 >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout) >> read(4, "", 4096) = 0 >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout) >> time(NULL) = 1196312447 >> read(4, "", 4096) = 0 >> close(4) = 0 >> munmap(0xb7f88000, 4096) = 0 >> open("/logs/alerts/2007/Nov/ossec-alerts-29.log", O_RDONLY|O_LARGEFILE) >> = -1 ENOENT (No such file or directory) --- SIGSEGV (Segmentation fault) >> @ 0 (0) --- >> >> >> Also, here the ossec.conf file: (clean from private information) >> >> Hope this help, >> >> ossec_config> >> <global> >> <email_notification>yes</email_notification> >> <email_to>[EMAIL PROTECTED]</email_to> >> <smtp_server>dddd.servername.com.</smtp_server> >> <email_from>[EMAIL PROTECTED]</email_from> >> </global> >> >> <email_alerts> >> <email_to>[EMAIL PROTECTED]</email_to> >> <rule_id>101702</rule_id> >> <do_not_delay /> >> <do_not_group /> >> </email_alerts> >> >> <email_alerts> >> <email_to>[EMAIL PROTECTED]</email_to> >> <rule_id>101702</rule_id> >> <do_not_delay /> >> <do_not_group /> >> </email_alerts> >> >> >> <syscheck> >> <!-- Frequency that syscheck is executed - default to every 6 hours >> --> <frequency>21600</frequency> >> >> <!-- Directories to check (perform all possible verifications) --> >> <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> >> <directories check_all="yes">/bin,/sbin</directories> >> >> <!-- Files/directories to ignore --> >> <ignore>/etc/mtab</ignore> >> <ignore>/etc/mnttab</ignore> >> <ignore>/etc/hosts.deny</ignore> >> <ignore>/etc/mail/statistics</ignore> >> <ignore>/etc/random-seed</ignore> >> <ignore>/etc/adjtime</ignore> >> <ignore>/etc/httpd/logs</ignore> >> <ignore>/etc/utmpx</ignore> >> <ignore>/etc/wtmpx</ignore> >> <ignore>/etc/cups/certs</ignore> >> <ignore>/etc/dumpdates</ignore> >> <ignore>/etc/svc/volatile</ignore> >> >> <!-- Windows files to ignore --> >> <ignore>C:\WINDOWS/System32/LogFiles</ignore> >> <ignore>C:\WINDOWS/Debug</ignore> >> <ignore>C:\WINDOWS/WindowsUpdate.log</ignore> >> <ignore>C:\WINDOWS/iis6.log</ignore> >> <ignore>C:\WINDOWS/system32/wbem/Logs</ignore> >> <ignore>C:\WINDOWS/system32/wbem/Repository</ignore> >> <ignore>C:\WINDOWS/Prefetch</ignore> >> <ignore>C:\WINDOWS/PCHEALTH/HELPCTR/DataColl</ignore> >> <ignore>C:\WINDOWS/SoftwareDistribution</ignore> >> <ignore>C:\WINDOWS/Temp</ignore> >> <ignore>C:\WINDOWS/system32/config</ignore> >> <ignore>C:\WINDOWS/system32/spool</ignore> >> <ignore>C:\WINDOWS/system32/CatRoot</ignore> >> </syscheck> >> >> <rootcheck> >> <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_file >> s> >> <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_ >> trojans> </rootcheck> >> >> <global> >> <white_list>127.0.0.1</white_list> >> <white_list>^localhost.localdomain$</white_list> >> <white_list>X.X.X.X</white_list> >> <white_list>X.X.X.X</white_list> >> </global> >> >> <remote> >> <connection>secure</connection> >> </remote> >> >> <alerts> >> <log_alert_level>1</log_alert_level> >> <email_alert_level>7</email_alert_level> >> </alerts> >> >> <command> >> <name>host-deny</name> >> <executable>host-deny.sh</executable> >> <expect>srcip</expect> >> <timeout_allowed>yes</timeout_allowed> >> </command> >> >> <command> >> <name>firewall-drop</name> >> <executable>firewall-drop.sh</executable> >> <expect>srcip</expect> >> <timeout_allowed>yes</timeout_allowed> >> </command> >> >> <command> >> <name>disable-account</name> >> <executable>disable-account.sh</executable> >> <expect>user</expect> >> <timeout_allowed>yes</timeout_allowed> >> </command> >> >> <command> >> <name>route-null</name> >> <executable>route-null.sh</executable> >> <expect>srcip</expect> >> <timeout_allowed>yes</timeout_allowed> >> </command> >> >> >> <!-- Active Response Config --> >> <active-response> >> <!-- This response is going to execute the host-deny >> - command for every event that fires a rule with >> - level (severity) >= 6. >> - The IP is going to be blocked for 600 seconds. >> --> >> <command>host-deny</command> >> <location>local</location> >> <level>6</level> >> <timeout>600</timeout> >> </active-response> >> >> <active-response> >> <!-- Firewall Drop response. Block the IP for >> - 600 seconds on the firewall (iptables, >> - ipfilter, etc). >> --> >> <command>firewall-drop</command> >> <location>local</location> >> <level>6</level> >> <timeout>600</timeout> >> </active-response> >> >> <remote> >> <connection>syslog</connection> >> <port>514</port> >> <allowed-ips>X.X.X.X</allowed-ips> >> <allowed-ips>X.X.X.X</allowed-ips> >> </remote> >> >> ----- Original Message ---- >> From: Daniel Cid <[EMAIL PROTECTED]> >> To: [email protected] >> Sent: Monday, November 26, 2007 9:05:51 PM >> Subject: [ossec-list] Re: maild always stop running >> >> >> Hi Pierre (and Aaron), >> >> Thanks for the report. I never saw similar behavior on ossec-maild, so >> I would need a bit more information >> to understand what is going on. Can you show us your config? Are you >> using the granular e-mail alerts? >> >> If possible, can you stop ossec-maild and start it manually using: >> >> >> # strace -f /var/ossec/bin/ossec-maild -d -d >> >> >> -Or (gdb is preferred) >> >> # gdb /var/ossec/bin/ossec-maild >> (gdb) set follow-fork-mode child >> (gdb) run -d -d --> (after it crashes, run bt) >> (gdb) bt >> >> >> Thanks, >> >> -- >> Daniel B. Cid >> dcid ( at ) ossec.net >> >> >> On Nov 26, 2007 10:40 AM, Aaron Bliss <[EMAIL PROTECTED]> wrote: >> > >> > I'm actually seeing the same issue. Server is running on RedHat ES 5 >> > box. No errors in the logs, the mailer daemon simply stops running >> > after 4 or 5 days.... >> > >> > Aaron >> > >> > >> > Pierre Boisvert wrote: >> > > Hi, >> > > >> > > I would to have some help to be able to find out why the maild >> process on my Ossec server is always stopping. >> > > >> > > I'm running ossec on fedora 7, with Ossec-WUI. Everything else is >> working fine. I don't see any message in the ossec.log file regarding >> this issue. >> > > >> > > Thanks in advance >> > > >> > > Timononk >> > > >> > > >> > > >> > > >> > > Get a sneak peak at messages with a handy reading pane with >> All new Yahoo! Mail: http://mail.yahoo.ca >> > > >> > >> > -- >> > Aaron Bliss >> > Systems Administrator >> > SUNY Brockport >> > (585) 395-2417 >> > >> > >> >> >> >> >> >> Looking for the perfect gift? Give the gift of Flickr! >> >> http://www.flickr.com/gift/ >> >> Richard Hopkins Information Services University of Bristol
