On Wed, Aug 25, 2010 at 3:23 AM, Aeterna <[email protected]> wrote: >> Where did you get the binaries? > > I compiled the binary myself, following the guide on > http://www.ossec.net/wiki/Know_How:BinaryInstall, used to make rolling > out on multiple servers much easier. > I edited the preloaded-vars.conf file with what I wanted and compiled, > installed without issue. then just extracted/imported the key from the > manager. > >> Are you getting email alerts for these files? >> Please post your entire agent.conf. I'm wondering if it's not getting used. >> Are other configurations in the agent.conf getting used? > > It seems that I'm confused on the agent.conf as it was giving errors > on the agent and it was not sending anymore alerts or responding to > syscheck/restart commands from the manager. After I replaced the > agent.conf manually with just having syscheck directories and the > logfiles to monitor, it'd restart again. > From what I understand the agent.conf should be the only config an > agent uses, right? So define the syscheck folders/logfiles to monitor > etcetera. However my agent says it has duplicate folders, which are > defined in ossec.conf. So it's not " use agent.conf instead of > ossec.conf" when it's found then? >
agent.conf and ossec.conf are combined. > I'm currently just using this as my agent.conf > > <agent_config> > <syscheck> > <frequency>21600</frequency> > <directories check_all="yes">/etc,/usr/bin,/usr/sbin,/bin,/sbin,/ > usr/src</directories> > <ignore>/etc/mtab</ignore> > <ignore>/etc/mnttab</ignore> > <ignore>/etc/hosts.deny</ignore> > <ignore>/etc/mail/statistics</ignore> > <ignore>/etc/random-seed</ignore> > <ignore>/etc/adjtime</ignore> > <ignore>/etc/httpd/logs</ignore> > <ignore>/etc/utmpx</ignore> > <ignore>/etc/wtmpx</ignore> > <ignore>/etc/cups/certs</ignore> > <ignore>/etc/dumpdates</ignore> > <ignore>/etc/svc/volatile</ignore> > <ignore>/etc/virtual/usage/</ignore> > <ignore>/etc/virtual/pophosts</ignore> > <ignore>/etc/virtual/pophosts_user</ignore> > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf</ignore> > <ignore>/etc/httpd/conf/extra/directadmin-vhosts.conf.back</ > ignore> > <ignore>/etc/virtual/domains</ignore> > <ignore>/etc/virtual/domainowners</ignore> > <ignore>/etc/proftpd.passwd</ignore> > <ignore>/etc/proftpd.vhosts.conf</ignore> > <ignore>/etc/named.conf</ignore> > </syscheck> > > <rootcheck> > <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</ > rootkit_files> > <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</ > rootkit_trojans> > </rootcheck> > > <active-response> > <disabled>yes</disabled> > </active-response> > Disabling AR also stops remotely restarting the agents. > <localfile> > <log_format>syslog</log_format> > <location>/var/log/messages</location> > </localfile> > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/auth.log</location> > </localfile> > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/syslog</location> > </localfile> > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/dpkg.log</location> > </localfile> > > </agent_config> > > It does email me alerts now, however the daily reports(rootcheck/ > syscheck) came all in the subject line, not the body. I don't understand. The body of the email is blank? > Also it's no longer giving me messages on the pophosts and > pophosts_users files anymore, so it's definitely in use now. >
