Q: How would I set up OSSEC to monitor ALL logins for the FTP site and to notify me if a file does not exist?
Setup/history: I currently have two FTP locations set up on IIS 6.0 - each assigned their own IP and log file location. One file seems to be reading correctly while the other does not (at least according to the messages in ossec.log). On further inspection, the daily file is not created for the BBBBBB location. Although it says it can't open the file, the next line says it is "Analyzing" the file. What is actually going on at the "analyzing" stage? My other problem is that I am not receiving any type of alerts notifying me 1 - that there is no file to be read 2 - I have login attempts in the AAAAAA folder that fail (Administrator below) Log messages: 2010/08/19 10:05:04 ossec-agent(1952): INFO: Monitoring variable log file: 'C:\WINDOWS\system32\LogFiles\AAAAAA \MSFTPSVC83247601\ex100819.log'. 2010/08/19 10:05:04 ossec-agent(1950): INFO: Analyzing file: 'C: \WINDOWS\system32\LogFiles\AAAAAA\MSFTPSVC83247601\ex100819.log'. 2010/08/19 10:05:04 ossec-agent(1952): INFO: Monitoring variable log file: 'C:\WINDOWS\System32\LogFiles\BBBBBB \MSFTPSVC883780927\ex100819.log'. 2010/08/19 10:05:04 ossec-agent(1103): ERROR: Unable to open file 'C: \WINDOWS\System32\LogFiles\BBBBBB\MSFTPSVC883780927\ex100819.log'. 2010/08/19 10:05:04 ossec-agent(1950): INFO: Analyzing file: 'C: \WINDOWS\System32\LogFiles\BBBBBB\MSFTPSVC883780927\ex100819.log'. Snippets from AAAAAA\..\ex100819.log 2010-08-19 14:10:19 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21 [40]PASS - 530 1326 2010-08-19 14:10:19 221.226.17.14 Administrator MSFTPSVC83247601 98.XX.XX.XX 21 [40]USER Administrator 331 0 2010-08-19 14:10:19 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21 [40]PASS - 530 1326 2010-08-19 14:10:20 221.226.17.14 Administrator MSFTPSVC83247601 98.XX.XX.XX 21 [40]USER Administrator 331 0 2010-08-19 14:10:20 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21 [40]PASS - 530 1326 2010-08-19 14:10:20 221.226.17.14 Administrator MSFTPSVC83247601 98.XX.XX.XX 21 [40]USER Administrator 331 0 2010-08-19 14:10:20 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21 [40]PASS - 530 1326 ... 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601 98.XX.XX.XX 21 [57]CWD /13g4ch 250 0 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601 98.XX.XX.XX 21 [57]MKD xh7zPw5k 257 0 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601 98.XX.XX.XX 21 [57]CWD /13g4ch 250 0 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601 98.XX.XX.XX 21 [57]CWD /13g4ch 250 0 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601 98.XX.XX.XX 21 [57]RMD xh7zPw5k 250 0 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601 98.XX.XX.XX 21 [57]CWD /13g4ch/541357Pc3Pt7h35 250 0 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601 98.XX.XX.XX 21 [57]CWD /13g4ch/541357Pc3Pt7h35 250 0
