I never got a reply on this. Was this fixed in 1.6.1?
On Sep 12, 3:38 pm, simpsonlang <[EMAIL PROTECTED]> wrote: > Just gave it a shot and this time the log: section shows something but > nothing matched the decoder. > > Sep 8 16:44:53aruba-controller.company.com [192.168.0.24] sapd[157]: > <106008> <ERRS> |[EMAIL PROTECTED] sapd| AM 00:0b:86:e1:df:00: > STA with MAC 00:17:f2:47:5f:0f is associating to a Rogue AP with SSID > Linksys Router and BSSID 00:18:39:cc:63:9f > > **Phase 1: Completed pre-decoding. > full event: 'Sep 8 16:44:53aruba-controller.company.com > [192.168.0.24] sapd[157]: <106008> <ERRS> |[EMAIL PROTECTED] > sapd| AM 00:0b:86:e1:df:00: STA with MAC 00:17:f2:47:5f:0f is > associating to a Rogue AP with SSID Linksys Router and BSSID > 00:18:39:cc:63:9f' > hostname: 'aruba-controller.company.com' > program_name: '(null)' > log: '[192.168.0.24] sapd[157]: <106008> <ERRS> |AParuba- > [EMAIL PROTECTED] sapd| AM 00:0b:86:e1:df:00: STA with MAC > 00:17:f2:47:5f:0f is associating to a Rogue AP with SSID Linksys > Router and BSSID 00:18:39:cc:63:9f' > > **Phase 2: Completed decoding. > No decoder matched. > > On Sep 12, 2:00 pm, "Daniel Cid" <[EMAIL PROTECTED]> wrote: > > > Hi, > > > Can you try with the following snapshot: > > >http://www.ossec.net/files/snapshots/ossec-hids-080912.tar.gz > > > It was a bug relating how we were parsing this specific syslog format > > (with the ip address > > following the hostname, instead of the program name). > > > Thanks, > > > -- > > Daniel B. Cid > > dcid ( at ) ossec.net > > > On Mon, Sep 8, 2008 at 2:04 PM, simpsonlang <[EMAIL PROTECTED]> wrote: > > > > I have install Ossec 1.6 and am not able to get the decoder to work > > > forArubalogs using the ossec-logtest. > > > > Thanks > > > > This is the local rule I'm using: > > > <rule id="100051" level="15"> > > > <match>is associating to a Rogue AP with SSID</match> > > > <if_fts /> > > > <description>Client Associating with Rogue AP Detected</ > > > description> > > > </rule> > > > > Log entry used: > > > Sep 8 16:44:53aruba-controller.company.com [192.168.0.24] sapd[157]: > > > <106008> <ERRS> |[EMAIL PROTECTED] sapd| AM 00:0b:86:e1:df:00: > > > STA with MAC 00:17:f2:47:5f:0f is associating to a Rogue AP with SSID > > > Linksys Router and BSSID 00:18:39:cc:63:9f > > > > Ossec-logtest output: > > > Sep 8 16:44:53aruba-controller.company.com [192.168.0.24] sapd[157]: > > > <106008> <ERRS> |[EMAIL PROTECTED] sapd| AM 00:0b:86:e1:df:00: > > > STA with MAC 00:17:f2:47:5f:0f is associating to a Rogue AP with SSID > > > Linksys Router and BSSID 00:18:39:cc:63:9f > > > > **Phase 1: Completed pre-decoding. > > > full event: 'Sep 8 16:44:53aruba-controller.company.com > > > [192.168.0.24] sapd[157]: <106008> <ERRS> |[EMAIL PROTECTED] > > > sapd| AM 00:0b:86:e1:df:00: STA with MAC 00:17:f2:47:5f:0f is > > > associating to a Rogue AP with SSID Linksys Router and BSSID > > > 00:18:39:cc:63:9f' > > > hostname: 'aruba-controller.company.com' > > > program_name: '' > > > log: '' > > > > **Phase 2: Completed decoding. > > > No decoder matched.
