Daniel - More data, just to muddy the waters.
The only way I have found it possible to create any agentd in the log file is by starting it with debug: [r...@yamaguchi bin]# /var/ossec/bin/ossec-agentd -d 2009/03/19 15:59:31 ossec-agentd: DEBUG: Starting ... This produces exactly one line in the log file: 2009/03/19 15:59:31 ossec-agentd: DEBUG: Starting ... and that's it. Even cranking agent.debug to 2 in internal_options puts nothing at all into the log. netstat thinks there's an established connection: [r...@yamaguchi bin]# netstat -uanep|grep ossec udp 0 0 192.168.5.2:54640 192.168.1.200:1514 ESTABLISHED 505 617649 18056/ossec-agentd ... but the server says otherwise: [r...@buran bin]# ./agent_control -l OSSEC HIDS agent_control. List of available agents: ID: 000, Name: buran.denmantire.com (server), IP: 127.0.0.1, Active/Local ID: 001, Name: gage, IP: 192.168.2.95, Active ID: 003, Name: saratoga, IP: 192.168.1.250, Active ID: 004, Name: tolstoy, IP: 192.168.1.75, Active ID: 005, Name: defiant, IP: 192.168.1.130, Active ID: 006, Name: challenger, IP: 192.168.1.79, Active ID: 007, Name: roosevelt, IP: 192.168.1.80, Active ID: 008, Name: chekov, IP: 192.168.254.50, Never connected ID: 010, Name: plcdata, IP: 192.168.1.150, Active ID: 011, Name: kantech, IP: 192.168.1.152, Active ID: 012, Name: dg, IP: 192.168.0.2, Active ID: 013, Name: kyushu, IP: 192.168.42.1, Active ID: 015, Name: antivirus, IP: 192.168.1.156, Active ID: 016, Name: yorktown, IP: 192.168.1.140, Active ID: 017, Name: melbourne, IP: 192.168.1.90, Active ID: 018, Name: princeton, IP: 192.168.4.78, Active ID: 019, Name: yamaguchi, IP: 192.168.42.254, Never connected The only thing I've noticed is that yamaguchi's IP address is 192.168.42.254, and netstat says it's listening at local address 192.168.5.2. That's because this is an OpenVPN gateway. I can't see an option to tell an agent which IP to bind to, so I tried setting up a new agent on the server called 'yamaguchi-vpn', with the 5.2 address, and giving that key to the agent on yamaguchi. No luck. I've deleted and re-done keys, just because. I'm not sure what to try next. Suggestions appreciated, up to and including 'uninstall and try it again'. Thanks, -- tim -- > > > Hi Tim, > > It is very strange that you don't have anything related to agentd in > your log. Generally, when > you start the agent you would get: > > r...@xxy:/root# cat /var/ossec/logs/ossec.log |grep agentd > > 2009/03/18 13:49:05 ossec-agentd(1410): INFO: Reading > authentication keys file. > 2009/03/18 13:49:05 ossec-agentd: INFO: Started (pid: 25133). > 2009/03/18 13:49:05 ossec-agentd: INFO: Server IP Address: > 192.168.2.xx > 2009/03/18 13:49:05 ossec-agentd: INFO: Trying to connect to server > (192.168.2.xx:1514). > 2009/03/18 13:49:11 ossec-agentd(4102): INFO: Connected to the server > (192.168.2.xx:1514). > > > Also, if you look at the manager's log, do you see anything? And using > tcpdump (on both sides)? > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > > On Mon, Mar 16, 2009 at 4:22 PM, Tim Boyer <[email protected]> wrote: > > > > Daniel - > > > > These machines are agents. As far as I can tell, they're > all running: > > > > [r...@yamaguchi ~]# ps -ef|grep ossec > > root 4594 1 0 Mar15 ? 00:00:00 > /var/ossec/bin/ossec-execd > > ossec 4598 1 0 Mar15 ? 00:00:00 > /var/ossec/bin/ossec-agentd > > root 4602 1 0 Mar15 ? 00:00:00 > > /var/ossec/bin/ossec-logcollector > > root 4606 1 0 Mar15 ? 00:00:34 > > /var/ossec/bin/ossec-syscheckd > > > > so I do a stop everything: > > > > [r...@yamaguchi ~]# /etc/init.d/ossec stop > > Stopping OSSEC: [ OK ] > > [r...@yamaguchi ~]# ps -ef|grep ossec > > [r...@yamaguchi ~]# > > > > and they all go away, and all of the lock files disappear. So, starting > > over everything: > > > > [r...@yamaguchi ~]# /etc/init.d/ossec start > > Starting OSSEC: [ OK ] > > [r...@yamaguchi ~]# ps -ef|grep ossec > > root 30569 1 0 15:05 ? 00:00:00 > /var/ossec/bin/ossec-execd > > ossec 30573 1 0 15:05 ? 00:00:00 > /var/ossec/bin/ossec-agentd > > root 30577 1 0 15:05 ? 00:00:00 > > /var/ossec/bin/ossec-logcollector > > root 30581 1 0 15:05 ? 00:00:00 > > /var/ossec/bin/ossec-syscheckd > > [r...@yamaguchi ~]# > > > > ... but the process still is locked: > > > > [r...@yamaguchi etc]# tail /var/log/ossec.log > > 2009/03/16 15:05:48 ossec-execd: INFO: Started (pid: 30569). > > 2009/03/16 15:05:53 ossec-syscheckd: INFO: Started (pid: 30581). > > 2009/03/16 15:05:53 ossec-rootcheck: INFO: Started (pid: 30581). > > 2009/03/16 15:05:54 ossec-logcollector(1950): INFO: Analyzing file: > > '/var/log/messages'. > > 2009/03/16 15:05:54 ossec-logcollector(1950): INFO: Analyzing file: > > '/var/log/auth.log'. > > 2009/03/16 15:05:54 ossec-logcollector(1950): INFO: Analyzing file: > > '/var/log/snort/alert'. > > 2009/03/16 15:05:54 ossec-logcollector: INFO: Started (pid: 30577). > > 2009/03/16 15:06:02 ossec-logcollector: WARN: Process > locked. Waiting for > > permission... > > 2009/03/16 15:14:50 ossec-syscheckd: INFO: Starting > syscheck scan (db). > > 2009/03/16 15:14:50 ossec-syscheckd: WARN: Process locked. > Waiting for > > permission... > > > > Versions. ossec-agentd 2.0, trying to talk to a 2.0 > server. ossec.conf: > > > > [r...@yamaguchi etc]# cat ossec.conf > > <ossec_config> > > <client> > > <server-ip>192.168.1.200</server-ip> > > </client> > > > > <syscheck> > > <!-- Frequency that syscheck is executed - default to > every 6 hours --> > > <frequency>21600</frequency> > > > > <!-- Directories to check (perform all possible > verifications) --> > > <directories > check_all="yes">/etc,/usr/bin,/usr/sbin</directories> > > <directories check_all="yes">/bin,/sbin</directories> > > > > <!-- Files/directories to ignore --> > > <ignore>/etc/mtab</ignore> > > <ignore>/etc/mnttab</ignore> > > <ignore>/etc/hosts.deny</ignore> > > <ignore>/etc/mail/statistics</ignore> > > <ignore>/etc/random-seed</ignore> > > <ignore>/etc/adjtime</ignore> > > <ignore>/etc/httpd/logs</ignore> > > <ignore>/etc/utmpx</ignore> > > <ignore>/etc/wtmpx</ignore> > > <ignore>/etc/cups/certs</ignore> > > <ignore>/etc/dumpdates</ignore> > > <ignore>/etc/svc/volatile</ignore> > > > > <!-- Windows files to ignore --> > > <ignore>C:\WINDOWS/System32/LogFiles</ignore> > > <ignore>C:\WINDOWS/Debug</ignore> > > <ignore>C:\WINDOWS/WindowsUpdate.log</ignore> > > <ignore>C:\WINDOWS/iis6.log</ignore> > > <ignore>C:\WINDOWS/system32/wbem/Logs</ignore> > > <ignore>C:\WINDOWS/system32/wbem/Repository</ignore> > > <ignore>C:\WINDOWS/Prefetch</ignore> > > <ignore>C:\WINDOWS/PCHEALTH/HELPCTR/DataColl</ignore> > > <ignore>C:\WINDOWS/SoftwareDistribution</ignore> > > <ignore>C:\WINDOWS/Temp</ignore> > > <ignore>C:\WINDOWS/system32/config</ignore> > > <ignore>C:\WINDOWS/system32/spool</ignore> > > <ignore>C:\WINDOWS/system32/CatRoot</ignore> > > </syscheck> > > > > <rootcheck> > > > <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files> > > > > > <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</ro > otkit_trojans> > > </rootcheck> > > <!-- Files to monitor (localfiles) --> > > > > <localfile> > > <log_format>syslog</log_format> > > <location>/var/log/messages</location> > > </localfile> > > > > <localfile> > > <log_format>syslog</log_format> > > <location>/var/log/auth.log</location> > > </localfile> > > > > <localfile> > > <log_format>snort-fast</log_format> > > <location>/var/log/snort/alert</location> > > </localfile> > > </ossec_config> > > [r...@yamaguchi etc]# > > > > and the error log says: > > > > [r...@yamaguchi etc]# grep -E "ERROR|WARN" /var/ossec/logs/ossec.log > > 2009/03/15 03:31:41 ossec-logcollector: WARN: Process > locked. Waiting for > > permission... > > 2009/03/15 03:32:18 ossec-logcollector: WARN: Process > locked. Waiting for > > permission... > > 2009/03/15 03:42:56 ossec-syscheckd: WARN: Process locked. > Waiting for > > permission... > > 2009/03/16 15:06:02 ossec-logcollector: WARN: Process > locked. Waiting for > > permission... > > 2009/03/16 15:14:50 ossec-syscheckd: WARN: Process locked. > Waiting for > > permission... > > > > and that's all. > > > > Thanks for any help or pointers - greatly appreciated! > > > > -- tim -- > > > > > >> > >> > >> Hi Tim, > >> > >> Were these systems installed as agents or "local" types? > Generally you > >> get this "locked" > >> warning, when analysisd (or ossec-agentd on the agent) can not be > >> accessed. Can you > >> see if they are running and maybe try restarting it all? > >> > >> If that still doesn't work, please share you config, > version of ossec > >> and full log dumps (generally a > >> cat /var/ossec/logs/ossec.log | grep -e "ERROR|WARN" should > >> be enough). > >> > >> Thanks, > >> > >> Thanks, > >> > >> -- > >> Daniel B. Cid > >> dcid ( at ) ossec.net > >> > >> On Sun, Mar 15, 2009 at 11:35 AM, Tim Boyer > >> <[email protected]> wrote: > >> > > >> > I've been avoiding SELinux like the plague - it's > >> permissive on this one, > >> > too: > >> > > >> > [r...@yamaguchi ~]# getenforce > >> > Permissive > >> > > >> > -- tim -- > >> > > >> >> > >> >> This sounds like maybe an SELinux issue. Check > >> /var/log/messages for > >> >> avc denies related to this. Is it possible SELinux is > >> >> permissive/disabled on the other servers not these ones? > >> >> > >> >> Ben > >> >> > >> >> On Sat, 2009-03-14 at 20:17 -0400, Tim Boyer wrote: > >> >> > I've got a half-dozen RHEL5.3 systems running OSSEC just > >> >> fine. And two > >> >> > RHEL5.3 systems that never will start up at all. > >> >> > > >> >> > There's no OSSEC processes running: > >> >> > > >> >> > [r...@yamaguchi ~]# ps -ef|grep ossec > >> >> > root 19348 32346 0 17:55 pts/0 00:00:00 grep ossec > >> >> > > >> >> > and nothing in the locks directory: > >> >> > > >> >> > [r...@yamaguchi ~]# ls -la /var/ossec/var/run/ > >> >> > total 16 > >> >> > drwxrwx--- 2 root ossec 4096 Mar 14 17:53 . > >> >> > dr-xr-x--- 3 root ossec 4096 Mar 14 17:53 .. > >> >> > > >> >> > but while the other systems start up and check in right > >> >> away, these two seem > >> >> > to hang forever: > >> >> > > >> >> > [r...@yamaguchi ~]# /etc/init.d/ossec start > >> >> > Starting OSSEC: > >> [ OK ] > >> >> > [r...@yamaguchi ~]# > >> >> > > >> >> > watch tail /var/log/ossec.log > >> >> > > >> >> > 009/03/14 17:57:03 ossec-execd: INFO: Started (pid: 19451). > >> >> > 2009/03/14 17:57:07 ossec-syscheckd: INFO: Started > (pid: 19463). > >> >> > 2009/03/14 17:57:07 ossec-rootcheck: INFO: Started > (pid: 19463). > >> >> > 2009/03/14 17:57:09 ossec-logcollector(1950): INFO: > >> Analyzing file: > >> >> > '/var/log/me > >> >> > ssages'. > >> >> > 2009/03/14 17:57:09 ossec-logcollector(1950): INFO: > >> Analyzing file: > >> >> > '/var/log/au > >> >> > th.log'. > >> >> > 2009/03/14 17:57:09 ossec-logcollector(1950): INFO: > >> Analyzing file: > >> >> > '/var/log/sn > >> >> > ort/alert'. > >> >> > 2009/03/14 17:57:09 ossec-logcollector: INFO: Started > >> (pid: 19459). > >> >> > 2009/03/14 17:57:23 ossec-logcollector: WARN: Process > >> >> locked. Waiting for > >> >> > permis > >> >> > sion... > >> >> > 2009/03/14 18:05:46 ossec-syscheckd: INFO: Starting > >> >> syscheck scan (db). > >> >> > 2009/03/14 18:05:46 ossec-syscheckd: WARN: Process locked. > >> >> Waiting for > >> >> > permissio > >> >> > n... > >> >> > > >> >> > Two hours later, it's still sitting there waiting for > permission. > >> >> > > >> >> > Pointers in the right direction greatly appreciated... > >> >> > > >> >> > > >> >> > > >> >> > > >> > > >> > > > > >
