Hi Jeannine, It was a bug in the way OSSEC was handling the uname function (it returns 0 on all OSs, except Solaris, where it returns any number >= 0). It is fixed on the following snapshot:
http://www.ossec.net/files/snapshots/ossec-hids-080818.tar.gz Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Aug 6, 2008 at 10:27 AM, Jeannine Bos <[EMAIL PROTECTED]> wrote: > > Does anyone know if this is a setup issue on my part? Or is there some > known issue with returning the Solaris host information? > > Jeannine > > kidplug wrote: >> I am getting the same thing on my Solaris agents. >> >> ossec has info on my server (also Solaris). >> The ossec ui web page shows: >> -ossec-server (127.0.0.1) >> Name: ossec-server >> IP: 127.0.0.1 >> Last keep alive: 2008 Aug 05 13:16:09 >> OS: SunOS orbit 5.9 Generic_122300-29 sun4u sparc SUNW,Sun-Fire- >> V210 >> >> But for the agents it shows (example): >> -earth (192.168.111.14) >> Name: earth >> IP: 192.168.111.14 >> Last keep alive: 2008 Aug 05 13:14:36 >> OS: No system info available - OSSEC HIDS v1.5.1 >> >> >> >> >> On Aug 5, 11:29 am, Jeannine Bos <[EMAIL PROTECTED]> wrote: >>> We are still in the process of playing around with a test server install >>> of OSSEC. We have several agents running on Windows, AIX and Solaris. >>> What I am seeing is that I am not getting agent info for the Solaris hosts. >>> >>> cat /ossec/queue/agent-info/tut-.* >>> >>> No system info available - OSSEC HIDS v1.5.1 >>> >>> The Windows and AIX agents return appropriate information. The agents >>> are connecting with the servers and I am getting alerts from these >>> servers just no host information. Is anyone else seeing this? The server >>> and the agents are running version 1.5.1. >>> >>> Jeannine Bos >
