I just installed web interface 0.3. Looks like everything is working
ok.The problem i have is when i try to search for log events for the
last 2 days and click
Search button it displays alerts found number but not the actual error messages.
I get the error "Nothing returned(or search expired).
I tried to run the search multiple times without any luck.
Results:
Total alerts found: 208
"Nothing returned (or search expired)" In Red letters
The ossec.log file on server is showing a lot of the following errors.
2008/03/25 16:08:10 ossec-dbd(5203): Error executing query 'INSERT
INTO data(id, server_id, "user",full_log) VALUES ('180', '1', 'xxx',
'WinEvtLog: Security: AUDIT_SUCCESS(540): Security: xxxx: systemxxx:
Successful Network Logon: User Name: xxxx Domain: xxx
Logon ID: (0x0,0x291A2CDC) Logon Type: 3 Logon Process:
NtLmSsp Authentication Package: NTLM Workstation Name: xxx
Logon GUID: - Caller User Name: - Caller Domain: - Caller
Logon ID: - Caller Process ID: - Transited Services: -
Source Network Address: 192.168.x.x Source Port: 0 ') '. Error:
'You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near '"user",full_log) VALUES ('180', '1', 'xxx', 'WinEvtLog:
Security: AUDIT_SUCCE' at line 1'.
2008/03/25 16:08:10 ossec-dbd(5209): Closing connection to database.
2008/03/25 16:08:10 ossec-dbd(5210): Attempting to reconnect to database.
2008/03/25 16:08:10 ossec-dbd: Connected to database 'ossec' at '127.0.0.1'.
2008/03/25 16:08:10 ossec-dbd(5204): Database error. Unable to run query.
2008/03/25 16:08:10 ossec-dbd(5203): Error executing query 'INSERT
INTO data(id, server_id, "user",full_log) VALUES ('181', '1', 'xxxx$',
'WinEvtLog: Security: AUDIT_SUCCESS(540): Security: xxxx$: systemxxx:
Successful Network Logon: User Name: xxx$ Domain: xxx
Logon ID: (0x0,0x2) Logon Type: 3 Logon Process: Kerberos
Authentication Package: Kerberos Workstation Name: Logon
GUID: {xxx} Caller User Name: - Caller Domain: - Caller
Logon ID: - Caller Process ID: - Transited Services: -
Source Network Address: 192.168.x.x Source Port: 0 ') '. Error:
'You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near '"user",full_log) VALUES ('181', '1', 'xxxx$', 'WinEvtLog:
Security: AUDIT_SUC' at line 1'.
2008/03/25 16:08:10 ossec-dbd(5208): Multiple database errors. Exiting.
