Hey folks,
I'm looking to deploy ossec on several servers but I'm running into
2-3 issues, which hopefully are simple and I'm just overlooking
something obvious. I'm using 2.4.1 on both server and agent, the
agent's installed through a binary to make the rollout automated
through a script.
So I've got a server installed and 1 agent who's getting a shared
config, verified by looking at the md5sum. These are DirectAdmin
servers so I've included this part to syscheck.
<ignore>/etc/virtual/usage/</ignore>
<ignore>/etc/virtual/pophosts</ignore>
<ignore>/etc/virtual/pophosts_user</ignore>
<ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf</ignore>
<ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf.back</
ignore>
<ignore>/etc/virtual/domains</ignore>
<ignore>/etc/virtual/domainowners</ignore>
<ignore>/etc/proftpd.passwd</ignore>
<ignore>/etc/proftpd.vhosts.conf</ignore>
<ignore>/etc/named.conf</ignore>
Now from what I understand this should stop the agent checking said
files and directory, however when I run /var/ossec/bin/
syscheck_control -i (id), it'll still show the /etc/virtual/pophosts &
pophosts_user files to have been changed.
The 2nd issue is that I'm not getting the daily reports e-mailed to
me, in my /var/ossec/etc/ossec.conf I have added the following:
<reports>
<category>syscheck</category>
<title>Daily report: syscheck</title>
<email_to>[email protected]</email_to>
</reports>
I can see in the /var/ossec/logs/ossec.log that it says after a filter
had been applied, it contains no alerts... while there clearly were
alerts that day. It ran at 1minute past midnight, but I'm assuming
that it still had the alerts in the alerts file at that point.
Then finally I set up another test server on an equal machine/distro
and decided to try a manual report from the cli and ran this command:
cat /var/ossec/logs/alerts/alerts.log | /var/ossec/bin/ossec-reportd -
n "Test summary"
This generated a summary of the alerts it had during that day, however
when I ran it on my first server, it just cat'd the alerts log file,
nothing else.
Not sure where to look on that one.
Thanks in advance.
