To give a small update/addition, when I run 'cat /var/ossec/logs/ alerts/alerts.log | /var/ossec/bin/ossec-reportd -n "Test Summary"' it's still cat'ing the alerts file directly, the ossec.log just shows this: 2010/08/25 14:48:18 ossec-reportd: INFO: Started (pid: 4251). 2010/08/25 14:48:23 ossec-reportd: INFO: Report 'Test Summary' completed. Creating output...
Also I noticed that with the posted agent.conf which omits /var/log/ mail.info, my alerts file is rapidly filling up with messages from that log, which again points to the agent still using the ossec.conf. I've already issued a restart for the agent from the manager twice, just to make sure. The first server is running on kernel 2.6.18.8, while the 2nd testserver is running 2.6.29 and both are running Debian Lenny. On Aug 25, 9:23 am, Aeterna <[email protected]> wrote: > > Where did you get the binaries? > > I compiled the binary myself, following the guide > onhttp://www.ossec.net/wiki/Know_How:BinaryInstall, used to make rolling > out on multiple servers much easier. > I edited the preloaded-vars.conf file with what I wanted and compiled, > installed without issue. then just extracted/imported the key from the > manager. > > > Are you getting email alerts for these files? > > Please post your entire agent.conf. I'm wondering if it's not getting used. > > Are other configurations in the agent.conf getting used? > > It seems that I'm confused on the agent.conf as it was giving errors > on the agent and it was not sending anymore alerts or responding to > syscheck/restart commands from the manager. After I replaced the > agent.conf manually with just having syscheck directories and the > logfiles to monitor, it'd restart again. > From what I understand the agent.conf should be the only config an > agent uses, right? So define the syscheck folders/logfiles to monitor > etcetera. However my agent says it has duplicate folders, which are > defined in ossec.conf. So it's not " use agent.conf instead of > ossec.conf" when it's found then? > > I'm currently just using this as my agent.conf > > <agent_config> > <syscheck> > <frequency>21600</frequency> > <directories check_all="yes">/etc,/usr/bin,/usr/sbin,/bin,/sbin,/ > usr/src</directories> > <ignore>/etc/mtab</ignore> > <ignore>/etc/mnttab</ignore> > <ignore>/etc/hosts.deny</ignore> > <ignore>/etc/mail/statistics</ignore> > <ignore>/etc/random-seed</ignore> > <ignore>/etc/adjtime</ignore> > <ignore>/etc/httpd/logs</ignore> > <ignore>/etc/utmpx</ignore> > <ignore>/etc/wtmpx</ignore> > <ignore>/etc/cups/certs</ignore> > <ignore>/etc/dumpdates</ignore> > <ignore>/etc/svc/volatile</ignore> > <ignore>/etc/virtual/usage/</ignore> > <ignore>/etc/virtual/pophosts</ignore> > <ignore>/etc/virtual/pophosts_user</ignore> > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf</ignore> > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf.back</ > ignore> > <ignore>/etc/virtual/domains</ignore> > <ignore>/etc/virtual/domainowners</ignore> > <ignore>/etc/proftpd.passwd</ignore> > <ignore>/etc/proftpd.vhosts.conf</ignore> > <ignore>/etc/named.conf</ignore> > </syscheck> > > <rootcheck> > <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</ > rootkit_files> > <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</ > rootkit_trojans> > </rootcheck> > > <active-response> > <disabled>yes</disabled> > </active-response> > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/messages</location> > </localfile> > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/auth.log</location> > </localfile> > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/syslog</location> > </localfile> > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/dpkg.log</location> > </localfile> > > </agent_config> > > It does email me alerts now, however the daily reports(rootcheck/ > syscheck) came all in the subject line, not the body. > Also it's no longer giving me messages on the pophosts and > pophosts_users files anymore, so it's definitely in use now. > > > There were no error messages at all on the first server when you ran > > the report manually? That's odd. > > Check the ossec-reportd file and permissions (file > > /var/ossec/bin/ossec-reportd ; ls -l /var/ossec/bin/ossec-reportd). > > These are the permissions I have for the file: > > -r-xr-x--- 1 root ossec 241863 Aug 10 10:23 /var/ossec/bin/ossec-reportd > > As for the permissions, they're exactly the same for everything in > the /var/ossec/bin directory. > > On Aug 24, 3:00 pm, "dan (ddp)" <[email protected]> wrote: > > > On Tue, Aug 24, 2010 at 7:15 AM, Aeterna <[email protected]> wrote: > > > Hey folks, > > > > I'm looking to deploy ossec on several servers but I'm running into > > > 2-3 issues, which hopefully are simple and I'm just overlooking > > > something obvious. I'm using 2.4.1 on both server and agent, the > > > agent's installed through a binary to make the rollout automated > > > through a script. > > > Where did you get the binaries? > > > > So I've got a server installed and 1 agent who's getting a shared > > > config, verified by looking at the md5sum. These are DirectAdmin > > > servers so I've included this part to syscheck. > > > <ignore>/etc/virtual/usage/</ignore> > > > <ignore>/etc/virtual/pophosts</ignore> > > > <ignore>/etc/virtual/pophosts_user</ignore> > > > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf</ignore> > > > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf.back</ > > > ignore> > > > <ignore>/etc/virtual/domains</ignore> > > > <ignore>/etc/virtual/domainowners</ignore> > > > <ignore>/etc/proftpd.passwd</ignore> > > > <ignore>/etc/proftpd.vhosts.conf</ignore> > > > <ignore>/etc/named.conf</ignore> > > > > Now from what I understand this should stop the agent checking said > > > files and directory, however when I run /var/ossec/bin/ > > > syscheck_control -i (id), it'll still show the /etc/virtual/pophosts & > > > pophosts_user files to have been changed. > > > Are you getting email alerts for these files? > > Please post your entire agent.conf. I'm wondering if it's not getting used. > > Are other configurations in the agent.conf getting used? > > > > The 2nd issue is that I'm not getting the daily reports e-mailed to > > > me, in my /var/ossec/etc/ossec.conf I have added the following: > > > > <reports> > > > <category>syscheck</category> > > > <title>Daily report: syscheck</title> > > > <email_to>[email protected]</email_to> > > > </reports> > > > > I can see in the /var/ossec/logs/ossec.log that it says after a filter > > > had been applied, it contains no alerts... while there clearly were > > > alerts that day. It ran at 1minute past midnight, but I'm assuming > > > that it still had the alerts in the alerts file at that point. > > > > Then finally I set up another test server on an equal machine/distro > > > and decided to try a manual report from the cli and ran this command: > > > cat /var/ossec/logs/alerts/alerts.log | /var/ossec/bin/ossec-reportd - > > > n "Test summary" > > > This generated a summary of the alerts it had during that day, however > > > when I ran it on my first server, it just cat'd the alerts log file, > > > nothing else. > > > Not sure where to look on that one. > > > > Thanks in advance. > > > There were no error messages at all on the first server when you ran > > the report manually? That's odd. > > Check the ossec-reportd file and permissions (file > > /var/ossec/bin/ossec-reportd ; ls -l /var/ossec/bin/ossec-reportd). > > These are the permissions I have for the file: > > -r-xr-x--- 1 root ossec 241863 Aug 10 10:23 /var/ossec/bin/ossec-reportd
