On Wed, Aug 18, 2010 at 9:16 AM, Michael Whitehead <[email protected]> wrote: > i have been having this report being triggered when there have not been any > failed logins. it shows my IP address as the one that is failing. am i > overlooking something really simple? > > <reports> > <category>authentication_failed</category> > <user type="relation">srcip</user> > <title>Daily report: Faild logins</title> > <email_to>whitehea...@xxxxxxxxxx</email_to> > </reports> > ___ > <reports> > <category>authentication_success</category> > <user type="relation">srcip</user> > <title>Daily report:Successful logins</title> > <email_to>whitehea...@xxxxxxxx</email_to> > </reports> > here is the successful login one. > Michael
Look through ossec/logs/alerts/YEAR/MONTH/ for authentication_failed alerts. It could be as simple as "gzcat /var/ossec/logs/alerts/2010/Aug/ossec-alerts-17.log.gz | more" and searching for "authentication_failed."
