Hi Richard,
ossec-hids-071218.tar.gz 18-Dec-2007 22:50 585K is the one I have
been using with success.
On 06/02/2008, Richard Hopkins <[EMAIL PROTECTED]> wrote:
>
>
> Thanks for this, Roch.
>
> My "truss" seems to have shown up the same problem...
>
> 29231: poll(0xFFBFE210, 0, 5000) = 0
> 29231: read(5, 0x000A2ABC, 8192) = 0
> 29231: poll(0xFFBFE210, 0, 5000) (sleeping...)
> 29231: poll(0xFFBFE210, 0, 5000) = 0
> 29231: time() = 1202256022
> 29231: read(5, 0x000A2ABC, 8192) = 0
> 29231: llseek(5, 0, SEEK_CUR) = 84763
> 29231: close(5) = 0
> 29231: open64("/logs/alerts/2008/Feb/ossec-alerts-06.log", O_RDONLY) Err#2
> ENOENT
> 29231: Incurred fault #6, FLTBOUNDS %pc = 0xFF1922E4
> 29231: siginfo: SIGSEGV SEGV_MAPERR addr=0x0000000C
> 29231: Received signal #11, SIGSEGV [default]
> 29231: siginfo: SIGSEGV SEGV_MAPERR addr=0x0000000C
>
> ...so I expect upgrading to a recent snapshot will fix the problem.
> Question is, though, which snapshot?
>
> ossec-hids-071129.tar.gz 29-Nov-2007 23:04 585K
> ossec-hids-071206.tar.gz 07-Dec-2007 00:59 585K
> ossec-hids-071211.tar.gz 11-Dec-2007 21:41 585K
> ossec-hids-071218.tar.gz 18-Dec-2007 22:50 585K
> ossec-hids-080123.tar.gz 23-Jan-2008 10:29 585K
>
> Cheers,
>
> Richard
>
> --On 01 February 2008 16:58 +0000 Roch <[EMAIL PROTECTED]> wrote:
>
> >
> > I had the same issues. Upgrading to the december snapshot fixed my
> > problem.
> >
> > On 01/02/2008, Richard Hopkins <[EMAIL PROTECTED]> wrote:
> >>
> >>
> >> Hi all,
> >>
> >> Since upgrading my (Solaris) ossec-hids server to version 1.4 I'm now
> >> seeing the problem of the dying "maild" process. Never seen this problem
> >> before.
> >>
> >> I'm currently running a "truss" (Solaris equivalent of strace) on the
> >> process to see what, if anything, shows up.
> >>
> >> Cheers,
> >>
> >> Richard
> >>
> >>
> >> --On 29 November 2007 21:06 -0400 Daniel Cid <[EMAIL PROTECTED]>
> >> wrote:
> >>
> >> >
> >> > Hi Pierre,
> >> >
> >> > Thanks for the information. I was able to find out where the bug is
> >> > and the fix is available at:
> >> >
> >> > http://www.ossec.net/files/snapshots/ossec-hids-071129.tar.gz
> >> >
> >> >
> >> > Just update to this new version and the problem should go away.
> >> >
> >> >
> >> > Thanks,
> >> >
> >> > --
> >> > Daniel B. Cid
> >> > dcid ( at ) ossec.net
> >> >
> >> >
> >> > On Nov 29, 2007 8:55 AM, Pierre Boisvert <[EMAIL PROTECTED]> wrote:
> >> >>
> >> >> Hi Daniel,
> >> >>
> >> >> Here the information you are requesting:
> >> >>
> >> >>
> >> >> Result of the strace:
> >> >>
> >> >> read(4, "", 4096) = 0
> >> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
> >> >> read(4, "", 4096) = 0
> >> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
> >> >> read(4, "", 4096) = 0
> >> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
> >> >> read(4, "", 4096) = 0
> >> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
> >> >> read(4, "", 4096) = 0
> >> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
> >> >> read(4, "", 4096) = 0
> >> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
> >> >> read(4, "", 4096) = 0
> >> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
> >> >> time(NULL) = 1196312447
> >> >> read(4, "", 4096) = 0
> >> >> close(4) = 0
> >> >> munmap(0xb7f88000, 4096) = 0
> >> >> open("/logs/alerts/2007/Nov/ossec-alerts-29.log",
> >> >> O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) ---
> >> >> SIGSEGV (Segmentation fault) @ 0 (0) ---
> >> >>
> >> >>
> >> >> Also, here the ossec.conf file: (clean from private information)
> >> >>
> >> >> Hope this help,
> >> >>
> >> >> ossec_config>
> >> >> <global>
> >> >> <email_notification>yes</email_notification>
> >> >> <email_to>[EMAIL PROTECTED]</email_to>
> >> >> <smtp_server>dddd.servername.com.</smtp_server>
> >> >> <email_from>[EMAIL PROTECTED]</email_from>
> >> >> </global>
> >> >>
> >> >> <email_alerts>
> >> >> <email_to>[EMAIL PROTECTED]</email_to>
> >> >> <rule_id>101702</rule_id>
> >> >> <do_not_delay />
> >> >> <do_not_group />
> >> >> </email_alerts>
> >> >>
> >> >> <email_alerts>
> >> >> <email_to>[EMAIL PROTECTED]</email_to>
> >> >> <rule_id>101702</rule_id>
> >> >> <do_not_delay />
> >> >> <do_not_group />
> >> >> </email_alerts>
> >> >>
> >> >>
> >> >> <syscheck>
> >> >> <!-- Frequency that syscheck is executed - default to every 6
> >> >> hours --> <frequency>21600</frequency>
> >> >>
> >> >> <!-- Directories to check (perform all possible verifications)
> >> >> --> <directories
> >> >> check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
> >> >> <directories check_all="yes">/bin,/sbin</directories>
> >> >>
> >> >> <!-- Files/directories to ignore -->
> >> >> <ignore>/etc/mtab</ignore>
> >> >> <ignore>/etc/mnttab</ignore>
> >> >> <ignore>/etc/hosts.deny</ignore>
> >> >> <ignore>/etc/mail/statistics</ignore>
> >> >> <ignore>/etc/random-seed</ignore>
> >> >> <ignore>/etc/adjtime</ignore>
> >> >> <ignore>/etc/httpd/logs</ignore>
> >> >> <ignore>/etc/utmpx</ignore>
> >> >> <ignore>/etc/wtmpx</ignore>
> >> >> <ignore>/etc/cups/certs</ignore>
> >> >> <ignore>/etc/dumpdates</ignore>
> >> >> <ignore>/etc/svc/volatile</ignore>
> >> >>
> >> >> <!-- Windows files to ignore -->
> >> >> <ignore>C:\WINDOWS/System32/LogFiles</ignore>
> >> >> <ignore>C:\WINDOWS/Debug</ignore>
> >> >> <ignore>C:\WINDOWS/WindowsUpdate.log</ignore>
> >> >> <ignore>C:\WINDOWS/iis6.log</ignore>
> >> >> <ignore>C:\WINDOWS/system32/wbem/Logs</ignore>
> >> >> <ignore>C:\WINDOWS/system32/wbem/Repository</ignore>
> >> >> <ignore>C:\WINDOWS/Prefetch</ignore>
> >> >> <ignore>C:\WINDOWS/PCHEALTH/HELPCTR/DataColl</ignore>
> >> >> <ignore>C:\WINDOWS/SoftwareDistribution</ignore>
> >> >> <ignore>C:\WINDOWS/Temp</ignore>
> >> >> <ignore>C:\WINDOWS/system32/config</ignore>
> >> >> <ignore>C:\WINDOWS/system32/spool</ignore>
> >> >> <ignore>C:\WINDOWS/system32/CatRoot</ignore>
> >> >> </syscheck>
> >> >>
> >> >> <rootcheck>
> >> >> <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_f
> >> >> ile s>
> >> >> <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootk
> >> >> it_ trojans> </rootcheck>
> >> >>
> >> >> <global>
> >> >> <white_list>127.0.0.1</white_list>
> >> >> <white_list>^localhost.localdomain$</white_list>
> >> >> <white_list>X.X.X.X</white_list>
> >> >> <white_list>X.X.X.X</white_list>
> >> >> </global>
> >> >>
> >> >> <remote>
> >> >> <connection>secure</connection>
> >> >> </remote>
> >> >>
> >> >> <alerts>
> >> >> <log_alert_level>1</log_alert_level>
> >> >> <email_alert_level>7</email_alert_level>
> >> >> </alerts>
> >> >>
> >> >> <command>
> >> >> <name>host-deny</name>
> >> >> <executable>host-deny.sh</executable>
> >> >> <expect>srcip</expect>
> >> >> <timeout_allowed>yes</timeout_allowed>
> >> >> </command>
> >> >>
> >> >> <command>
> >> >> <name>firewall-drop</name>
> >> >> <executable>firewall-drop.sh</executable>
> >> >> <expect>srcip</expect>
> >> >> <timeout_allowed>yes</timeout_allowed>
> >> >> </command>
> >> >>
> >> >> <command>
> >> >> <name>disable-account</name>
> >> >> <executable>disable-account.sh</executable>
> >> >> <expect>user</expect>
> >> >> <timeout_allowed>yes</timeout_allowed>
> >> >> </command>
> >> >>
> >> >> <command>
> >> >> <name>route-null</name>
> >> >> <executable>route-null.sh</executable>
> >> >> <expect>srcip</expect>
> >> >> <timeout_allowed>yes</timeout_allowed>
> >> >> </command>
> >> >>
> >> >>
> >> >> <!-- Active Response Config -->
> >> >> <active-response>
> >> >> <!-- This response is going to execute the host-deny
> >> >> - command for every event that fires a rule with
> >> >> - level (severity) >= 6.
> >> >> - The IP is going to be blocked for 600 seconds.
> >> >> -->
> >> >> <command>host-deny</command>
> >> >> <location>local</location>
> >> >> <level>6</level>
> >> >> <timeout>600</timeout>
> >> >> </active-response>
> >> >>
> >> >> <active-response>
> >> >> <!-- Firewall Drop response. Block the IP for
> >> >> - 600 seconds on the firewall (iptables,
> >> >> - ipfilter, etc).
> >> >> -->
> >> >> <command>firewall-drop</command>
> >> >> <location>local</location>
> >> >> <level>6</level>
> >> >> <timeout>600</timeout>
> >> >> </active-response>
> >> >>
> >> >> <remote>
> >> >> <connection>syslog</connection>
> >> >> <port>514</port>
> >> >> <allowed-ips>X.X.X.X</allowed-ips>
> >> >> <allowed-ips>X.X.X.X</allowed-ips>
> >> >> </remote>
> >> >>
> >> >> ----- Original Message ----
> >> >> From: Daniel Cid <[EMAIL PROTECTED]>
> >> >> To: [email protected]
> >> >> Sent: Monday, November 26, 2007 9:05:51 PM
> >> >> Subject: [ossec-list] Re: maild always stop running
> >> >>
> >> >>
> >> >> Hi Pierre (and Aaron),
> >> >>
> >> >> Thanks for the report. I never saw similar behavior on ossec-maild, so
> >> >> I would need a bit more information
> >> >> to understand what is going on. Can you show us your config? Are you
> >> >> using the granular e-mail alerts?
> >> >>
> >> >> If possible, can you stop ossec-maild and start it manually using:
> >> >>
> >> >>
> >> >> # strace -f /var/ossec/bin/ossec-maild -d -d
> >> >>
> >> >>
> >> >> -Or (gdb is preferred)
> >> >>
> >> >> # gdb /var/ossec/bin/ossec-maild
> >> >> (gdb) set follow-fork-mode child
> >> >> (gdb) run -d -d --> (after it crashes, run bt)
> >> >> (gdb) bt
> >> >>
> >> >>
> >> >> Thanks,
> >> >>
> >> >> --
> >> >> Daniel B. Cid
> >> >> dcid ( at ) ossec.net
> >> >>
> >> >>
> >> >> On Nov 26, 2007 10:40 AM, Aaron Bliss <[EMAIL PROTECTED]> wrote:
> >> >> >
> >> >> > I'm actually seeing the same issue. Server is running on RedHat ES
> >> >> > 5 box. No errors in the logs, the mailer daemon simply stops
> >> >> > running after 4 or 5 days....
> >> >> >
> >> >> > Aaron
> >> >> >
> >> >> >
> >> >> > Pierre Boisvert wrote:
> >> >> > > Hi,
> >> >> > >
> >> >> > > I would to have some help to be able to find out why the maild
> >> >> process on my Ossec server is always stopping.
> >> >> > >
> >> >> > > I'm running ossec on fedora 7, with Ossec-WUI. Everything else is
> >> >> working fine. I don't see any message in the ossec.log file
> >> >> regarding this issue.
> >> >> > >
> >> >> > > Thanks in advance
> >> >> > >
> >> >> > > Timononk
> >> >> > >
> >> >> > >
> >> >> > >
> >> >> > >
> >> >> > > Get a sneak peak at messages with a handy reading pane with
> >> >> All new Yahoo! Mail: http://mail.yahoo.ca
> >> >> > >
> >> >> >
> >> >> > --
> >> >> > Aaron Bliss
> >> >> > Systems Administrator
> >> >> > SUNY Brockport
> >> >> > (585) 395-2417
> >> >> >
> >> >> >
> >> >>
> >> >>
> >> >>
> >> >>
> >> >>
> >> >> Looking for the perfect gift? Give the gift of Flickr!
> >> >>
> >> >> http://www.flickr.com/gift/
> >> >>
> >> >>
> >>
> >>
> >>
> >> Richard Hopkins
> >> Information Services
> >> University of Bristol
> >>
> >>
>
>
>
> Richard Hopkins
> Information Services
> University of Bristol
>
>
