Hi guys,

I've been battling with this for a good few weeks now and am starting to
wonder if it is even possible to do what I want.  Here goes.

My goal:
When any file(s) or folder(s) within the c:\testing_ossec/ directory of
SERVER1 are added/removed/changed an email alert will be sent to
[email protected].  No other alerts about this server should be
sent to [email protected].

My config:
Server: Ubuntu 8.04.2 running OSSEC HIDS 2.0 (server)

email_alerts from /var/ossec/etc/ossec.conf:

<ossec_config>
        <email_alerts>
                <email_to>[email protected]</email_to>
                <event_location>SERVER1</event_location>
                <rule_id>100105</rule_id>
                <level>14</level>
                <group>syscheck</group>
                <do_not_delay />
                <do_not_group />
        </email_alerts>
</ossec_config>

Rule 100105 from /var/ossec/rules/local_rules.xml:

  <rule id="100105" level="15">
    <hostname>SERVER1</hostname>
    <match>testing_ossec</match>
    <description>Test rule for specific email alerts</description>
  </rule>

Client (SERVER1): Windows Server 2003 Enterprise w/SP2 running OSSEC HIDS
2.0 (client)

My addition to C:\Program Files\ossec-agent\ossec.conf:

<directories check_all="yes">C:\testing_ossec</directories>

My results:
Once I specified the rule_id 100105 within the <ossec_config> ->
<email_alerts> I get nothing.  If I leave that tag out then it will at least
send me notification about deleted files, but nothing for new or modified
files. Before adding the <level> and <group> tags it would also send me all
other unrelated notifications from the host.  I added those two tags and
have disabled email grouping to avoid sending the unrelated alerts to the
user, but it still seems to be missing those alerts about new or modified
files.  I started out on OSSEC HIDS 1.5, then upgraded the server and
clients all to v2.0, and I even rebuilt the Ubuntu server and reinstalled
the clients but no luck.  Could anybody please help me to see where I am
failing with this?

Thank you,

Nick

Reply via email to