Daniel Cid wrote: > Hi Dennis, > > I never saw that before. The snapshot was very stable and didn't > change anything related to syscheck > or how the alerts are created. Can you see if ossec is running (did > you try to stop/start it)? Is there anything at > /var/ossec/logs/ossec.log? A little more information would be helpful: > > http://www.ossec.net/wiki/index.php/Community_manual:BugReport > > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net
Daniel, The only alerts I got was from syscheck. Everything else stopped. all process were running so I filed a bug on bugzilla. I don't have the ability to attach log files there, so I am attaching them here. Ossec was started at 10:53 and I saved the logs about 13:35. You will see that the only thing logged from that time on was the startup. See bug 163 for the rest of the information. I have gone back to 1.4. Regards, Dennis -- Dennis Golden Golden Consulting Services, Inc.
Rule: 103302 (level 6) -> 'PBL reject code for spamhaus (Service unavailable).' Src IP: 86.153.62.204 User: (none) Apr 8 10:44:38 goldens2 postfix/smtpd[11575]: NOQUEUE: reject: RCPT from host86-153-62-204.range86-153.btcentralplus.com[86.153.62.204]: 421 4.7.1 Service unavailable; Client host [86.153.62.204] blocked using zen.spamhaus.org=127.0.0.11; http://www.spamhaus.org/query/bl?ip=86.153.62.204; from=<[EMAIL PROTECTED]> to=<[EMAIL PROTECTED]> proto=SMTP helo=<owner8f2966e0e.home> ** Alert 1207669687.89955: - syslog,Postfix,spam, 2008 Apr 08 10:48:07 goldens2->/var/log/mail.info Rule: 103302 (level 6) -> 'PBL reject code for spamhaus (Service unavailable).' Src IP: 201.3.47.67 User: (none) Apr 8 10:48:06 goldens2 postfix/smtpd[11727]: NOQUEUE: reject: RCPT from 201-3-47-67.bsace705.dsl.brasiltelecom.net.br[201.3.47.67]: 421 4.7.1 Service unavailable; Client host [201.3.47.67] blocked using zen.spamhaus.org=127.0.0.11; http://www.spamhaus.org/query/bl?ip=201.3.47.67; from=<[EMAIL PROTECTED]> to=<[EMAIL PROTECTED]> proto=ESMTP helo=<201-3-47-67.bsace705.dsl.brasiltelecom.net.br> ** Alert 1207669777.90583: - syslog,postfix,spam, 2008 Apr 08 10:49:37 goldens2->/var/log/mail.info Rule: 3303 (level 5) -> 'Sender domain is not found (450: Requested mail action not taken).' Src IP: 61.247.12.58 User: (none) Apr 8 10:49:36 goldens2 postfix/smtpd[11727]: NOQUEUE: reject: RCPT from unknown[61.247.12.58]: 450 4.7.1 <58.12.247.61.fast.net.id>: Helo command rejected: Host not found; from=<[EMAIL PROTECTED]> to=<[EMAIL PROTECTED]> proto=ESMTP helo=<58.12.247.61.fast.net.id> ** Alert 1207669839.91104: - syslog,Postfix,spam, 2008 Apr 08 10:50:39 goldens2->/var/log/mail.info Rule: 103302 (level 6) -> 'PBL reject code for spamhaus (Service unavailable).' Src IP: 79.126.196.85 User: (none) Apr 8 10:50:37 goldens2 postfix/smtpd[11727]: NOQUEUE: reject: RCPT from unknown[79.126.196.85]: 421 4.7.1 Service unavailable; Client host [79.126.196.85] blocked using zen.spamhaus.org=127.0.0.11; http://www.spamhaus.org/query/bl?ip=79.126.196.85; from=<[EMAIL PROTECTED]> to=<[EMAIL PROTECTED]> proto=SMTP helo=<cjebj> ** Alert 1207669879.91655: - syslog,postfix,spam, 2008 Apr 08 10:51:19 goldens2->/var/log/mail.info Rule: 3303 (level 5) -> 'Sender domain is not found (450: Requested mail action not taken).' Src IP: 206.137.20.197 User: (none) Apr 8 10:51:19 goldens2 postfix/smtpd[11727]: NOQUEUE: reject: RCPT from wn.webnotions.com[206.137.20.197]: 450 4.7.1 <wn.a1books.com>: Helo command rejected: Host not found; from=<[EMAIL PROTECTED]> to=<[EMAIL PROTECTED]> proto=ESMTP helo=<wn.a1books.com> ** Alert 1207670001.92159: mail - ossec, 2008 Apr 08 10:53:21 goldens2->ossec-monitord Rule: 502 (level 3) -> 'Ossec server started.' Src IP: (none) User: (none) ossec: Ossec started.
2008/04/04 20:16:07 ossec-maild: Started (pid: 5653). 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'rules_config.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'pam_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'sshd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'telnetd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'syslog_rules.xml' 2008/04/04 20:16:07 ossec-rootcheck: System audit file not configured. 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'arpwatch_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'symantec-av_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'symantec-ws_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'pix_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'named_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'smbd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'vsftpd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'pure-ftpd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'proftpd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'ms_ftpd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'hordeimp_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'vpopmail_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'courier_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'web_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'apache_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'mysql_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'postgresql_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'ids_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'squid_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'firewall_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'cisco-ios_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'netscreenfw_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'sonicwall_rules.xml' 2008/04/04 20:16:07 ossec-execd: Started (pid: 5657). 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'postfix_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'sendmail_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'imapd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'mailscanner_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'ms-exchange_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'racoon_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'vpn_concentrator_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'spamd_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'msauth_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'attack_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'zeus_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'ossec_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Reading rules file: 'local_rules.xml' 2008/04/04 20:16:07 ossec-analysisd: Total rules enabled: '693' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/mtab' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/mnttab' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/hosts.deny' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/mail/statistics' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/random-seed' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/adjtime' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/httpd/logs' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/utmpx' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/wtmpx' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/cups/certs' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/dumpdates' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: '/etc/svc/volatile' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/System32/LogFiles' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Debug' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/WindowsUpdate.log' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/iis6.log' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/wbem/Logs' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/wbem/Repository' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Prefetch' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/PCHEALTH/HELPCTR/DataColl' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/SoftwareDistribution' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Temp' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/config' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/spool' 2008/04/04 20:16:07 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/CatRoot' 2008/04/04 20:16:07 ossec-analysisd: White listing IP: '127.0.0.1' 2008/04/04 20:16:07 ossec-analysisd: White listing IP: '192.168.1.11' 2008/04/04 20:16:07 ossec-analysisd: White listing IP: '192.168.1.1' 2008/04/04 20:16:07 ossec-analysisd: 3 IPs in the white list for active response. 2008/04/04 20:16:07 ossec-analysisd: White listing Hostname: 'localhost.localdomain' 2008/04/04 20:16:07 ossec-analysisd: 1 Hostname(s) in the white list for active response. 2008/04/04 20:16:07 ossec-analysisd: Started (pid: 5661). 2008/04/04 20:16:08 ossec-monitord: Started (pid: 5673). 2008/04/04 20:16:10 ossec-syscheckd: Started (pid: 5669). 2008/04/04 20:16:10 ossec-rootcheck: Started (pid: 5669). 2008/04/04 20:16:10 ossec-analysisd: Connected to '/queue/alerts/execq' (exec queue) 2008/04/04 20:16:13 ossec-logcollector(1950): Analyzing file: '/var/log/messages'. 2008/04/04 20:16:13 ossec-logcollector(1950): Analyzing file: '/var/log/mail.info'. 2008/04/04 20:16:13 ossec-logcollector: Started (pid: 5665). 2008/04/08 10:52:01 ossec-monitord(1225): SIGNAL Received. Exit Cleaning... 2008/04/08 10:52:01 ossec-logcollector(1225): SIGNAL Received. Exit Cleaning... 2008/04/08 10:52:01 ossec-syscheckd(1225): SIGNAL Received. Exit Cleaning... 2008/04/08 10:52:01 ossec-analysisd(1225): SIGNAL Received. Exit Cleaning... 2008/04/08 10:52:01 ossec-maild(1225): SIGNAL Received. Exit Cleaning... 2008/04/08 10:52:01 ossec-execd(1314): Shutdown received. Deleting responses. 2008/04/08 10:52:01 ossec-execd(1225): SIGNAL Received. Exit Cleaning... 2008/04/08 10:53:10 ossec-maild: Started (pid: 12942). 2008/04/08 10:53:10 ossec-execd: Started (pid: 12946). 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'rules_config.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'pam_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'sshd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'telnetd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'syslog_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'arpwatch_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'symantec-av_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'symantec-ws_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'pix_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'named_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'smbd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'vsftpd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'pure-ftpd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'proftpd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'ms_ftpd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'hordeimp_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'vpopmail_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'courier_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'web_rules.xml' 2008/04/08 10:53:10 ossec-rootcheck: System audit file not configured. 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'apache_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'mysql_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'postgresql_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'ids_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'squid_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'firewall_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'cisco-ios_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'netscreenfw_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'sonicwall_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'postfix_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'sendmail_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'imapd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'mailscanner_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'ms-exchange_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'racoon_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'vpn_concentrator_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'spamd_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'msauth_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'attack_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'zeus_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'ossec_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Reading rules file: 'local_rules.xml' 2008/04/08 10:53:10 ossec-analysisd: Total rules enabled: '695' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/mtab' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/mnttab' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/hosts.deny' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/mail/statistics' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/random-seed' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/adjtime' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/httpd/logs' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/utmpx' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/wtmpx' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/cups/certs' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/dumpdates' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: '/etc/svc/volatile' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/System32/LogFiles' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Debug' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/WindowsUpdate.log' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/iis6.log' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/wbem/Logs' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/wbem/Repository' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Prefetch' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/PCHEALTH/HELPCTR/DataColl' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/SoftwareDistribution' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Temp' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/config' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/spool' 2008/04/08 10:53:10 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/CatRoot' 2008/04/08 10:53:10 ossec-analysisd: White listing IP: '127.0.0.1' 2008/04/08 10:53:10 ossec-analysisd: White listing IP: '192.168.1.11' 2008/04/08 10:53:10 ossec-analysisd: White listing IP: '192.168.1.1' 2008/04/08 10:53:10 ossec-analysisd: 3 IPs in the white list for active response. 2008/04/08 10:53:10 ossec-analysisd: White listing Hostname: 'localhost.localdomain' 2008/04/08 10:53:10 ossec-analysisd: 1 Hostname(s) in the white list for active response. 2008/04/08 10:53:10 ossec-analysisd: Started (pid: 12950). 2008/04/08 10:53:11 ossec-monitord: Started (pid: 12963). 2008/04/08 10:53:13 ossec-analysisd: Connected to '/queue/alerts/execq' (exec queue) 2008/04/08 10:53:13 ossec-syscheckd: Started (pid: 12959). 2008/04/08 10:53:13 ossec-rootcheck: Started (pid: 12959). 2008/04/08 10:53:16 ossec-logcollector(1950): Analyzing file: '/var/log/messages'. 2008/04/08 10:53:16 ossec-logcollector(1950): Analyzing file: '/var/log/mail.info'. 2008/04/08 10:53:16 ossec-logcollector: Started (pid: 12954).
