On Thu, Aug 19, 2010 at 11:51 AM, Frank <[email protected]> wrote:
> Q: How would I set up OSSEC to monitor ALL logins for the FTP site and
> to notify me if a file does not exist?
>
> Setup/history:
> I currently have two FTP locations set up on IIS 6.0 - each assigned
> their own IP and log file location.
> One file seems to be reading correctly while the other does not (at
> least according to the messages in ossec.log). On further inspection,
> the daily file is not created for the BBBBBB location. Although it
> says it can't open the file, the next line says it is "Analyzing" the
> file. What is actually going on at the "analyzing" stage?
>
> My other problem is that I am not receiving any type of alerts
> notifying me
> 1 - that there is no file to be read
> 2 - I have login attempts in the AAAAAA folder that fail
> (Administrator below)
>
>
> Log messages:
> 2010/08/19 10:05:04 ossec-agent(1952): INFO: Monitoring variable log
> file: 'C:\WINDOWS\system32\LogFiles\AAAAAA
> \MSFTPSVC83247601\ex100819.log'.
>
> 2010/08/19 10:05:04 ossec-agent(1950): INFO: Analyzing file: 'C:
> \WINDOWS\system32\LogFiles\AAAAAA\MSFTPSVC83247601\ex100819.log'.
>
> 2010/08/19 10:05:04 ossec-agent(1952): INFO: Monitoring variable log
> file: 'C:\WINDOWS\System32\LogFiles\BBBBBB
> \MSFTPSVC883780927\ex100819.log'.
>
> 2010/08/19 10:05:04 ossec-agent(1103): ERROR: Unable to open file 'C:
> \WINDOWS\System32\LogFiles\BBBBBB\MSFTPSVC883780927\ex100819.log'.
>
> 2010/08/19 10:05:04 ossec-agent(1950): INFO: Analyzing file: 'C:
> \WINDOWS\System32\LogFiles\BBBBBB\MSFTPSVC883780927\ex100819.log'.
>
>
> Snippets from AAAAAA\..\ex100819.log
>
> 2010-08-19 14:10:19 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21
> [40]PASS - 530 1326
> 2010-08-19 14:10:19 221.226.17.14 Administrator MSFTPSVC83247601
> 98.XX.XX.XX 21 [40]USER Administrator 331 0
> 2010-08-19 14:10:19 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21
> [40]PASS - 530 1326
> 2010-08-19 14:10:20 221.226.17.14 Administrator MSFTPSVC83247601
> 98.XX.XX.XX 21 [40]USER Administrator 331 0
> 2010-08-19 14:10:20 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21
> [40]PASS - 530 1326
> 2010-08-19 14:10:20 221.226.17.14 Administrator MSFTPSVC83247601
> 98.XX.XX.XX 21 [40]USER Administrator 331 0
> 2010-08-19 14:10:20 221.226.17.14 - MSFTPSVC83247601 98.XX.XX.XX 21
> [40]PASS - 530 1326
> ...
> 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
> 98.XX.XX.XX 21 [57]CWD /13g4ch 250 0
> 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
> 98.XX.XX.XX 21 [57]MKD xh7zPw5k 257 0
> 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
> 98.XX.XX.XX 21 [57]CWD /13g4ch 250 0
> 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
> 98.XX.XX.XX 21 [57]CWD /13g4ch 250 0
> 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
> 98.XX.XX.XX 21 [57]RMD xh7zPw5k 250 0
> 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
> 98.XX.XX.XX 21 [57]CWD /13g4ch/541357Pc3Pt7h35 250 0
> 2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
> 98.XX.XX.XX 21 [57]CWD /13g4ch/541357Pc3Pt7h35 250 0
I don't know about the analyzing issues, but the logs you posted don't
seem to have real rules associated with them:
**Phase 1: Completed pre-decoding.
full event: '2010-08-19 14:10:19 221.226.17.14 -
MSFTPSVC83247601 98.XX.XX.XX 21 [40]PASS - 530 1326'
hostname: 'ix'
program_name: '(null)'
log: '2010-08-19 14:10:19 221.226.17.14 - MSFTPSVC83247601
98.XX.XX.XX 21 [40]PASS - 530 1326'**Phase 2: Completed decoding.
decoder: 'windows-date-format'
**Phase 3: Completed filtering (rules).
Rule id: '11500'
Level: '0'
Description: 'Grouping for the Microsoft ftp rules.'
2010-08-19 14:10:19 221.226.17.14 Administrator MSFTPSVC83247601
98.XX.XX.XX 21 [40]USER Administrator 331 0
**Phase 1: Completed pre-decoding.
full event: '2010-08-19 14:10:19 221.226.17.14 Administrator
MSFTPSVC83247601 98.XX.XX.XX 21 [40]USER Administrator 331 0'
hostname: 'ix'
program_name: '(null)'
log: '2010-08-19 14:10:19 221.226.17.14 Administrator
MSFTPSVC83247601 98.XX.XX.XX 21 [40]USER Administrator 331 0'
**Phase 2: Completed decoding.
decoder: 'windows-date-format'
**Phase 3: Completed filtering (rules).
Rule id: '11500'
Level: '0'
Description: 'Grouping for the Microsoft ftp rules.'
2010-08-19 14:10:22 98.XX.XX.XX xxxxxxxxxxxx MSFTPSVC83247601
98.XX.XX.XX 21 [57]CWD /13g4ch 250 0
You may have to write your own rules to get the alerts you're looking for.
