[ossec-list] syscheck start time

Jakub Moravek Thu, 18 Jun 2009 05:27:33 -0700

Hello,
   I am trying to setup ossec 2.0 agent for Windows workstations. I
would like to start syscheck at specific days during lunch time. I set
up parametres scan_time and scan_day and disabled scan_on_start. But
syscheck does not start. Below is my ossec.conf from windows agent. Do
you have any suggestions what am I doing wrong?


   Jakub

<ossec_config>
  <syscheck>
    <scan_on_start>no</scan_on_start>
    <scan_time>11</scan_time>
    <scan_day>wednesday, thursday</scan_day>
    <directories check_all="yes">%WINDIR%,C:\Program Files</
directories>

    <!-- Default files to be ignored. -->
    <ignore>%WINDIR%/System32/LogFiles</ignore>
    <ignore>%WINDIR%/system32/wbem/Logs</ignore>
    <ignore>%WINDIR%/system32/config</ignore>
    <ignore>%WINDIR%/system32/CatRoot</ignore>
    <ignore>%WINDIR%/system32/wbem/Repository</ignore>
    <ignore>%WINDIR%/system32/dllcache</ignore>
    <ignore>%WINDIR%/system32/inetsrv/History</ignore>
    <ignore>%WINDIR%/system32/winevt/Logs</ignore>
    <ignore>%WINDIR%/system32/spool</ignore>
    <ignore>%WINDIR%/system32/Tasks</ignore>
    <ignore type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$</
ignore>


    <!-- Windows registry entries to monitor. -->
    <windows_registry>HKEY_LOCAL_MACHINE\Software\Policies</
windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT
\CurrentVersion</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\Software\Classes</
windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Services</windows_registry>
    <windows_registry>HKEY_LOCAL_MACHINE\Security</windows_registry>

    <!-- Windows registry entries to ignore. -->
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\Installer\UserData</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\Group Policy\State</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\WindowsUpdate</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
\CurrentVersion\Internet Settings\Cache</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT
\CurrentVersion\ProfileList</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT
\CurrentVersion\Prefetcher</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT
\CurrentVersion\Schedule\TaskCache</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\Interface</
registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\TypeLib</
registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\MIME</
registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\Software</
registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\CLSID</
registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Security\Policy\Secrets</
registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\Security\SAM\Domains\Account
\Users</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\DeviceClasses</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\Watchdog</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\MediaCategories</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\Windows</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\hivelist</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\ServiceCurrent</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\Print</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Control\Session Manager</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Services\Eventlog</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Services\RemoteAccess\Performance</registry_ignore>
    <registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet
\Services\W32Time\TimeProviders\NtpClient</registry_ignore>
    <registry_ignore type="sregex">\Enum$</registry_ignore>
  </syscheck>

  <rootcheck>
    <disabled>yes</disabled>
  </rootcheck>

</ossec_config>


<ossec_config>
   <client>
      <server-ip>1.2.3.4</server-ip>
   </client>
</ossec_config>

[ossec-list] syscheck start time

Reply via email to