On Wed, Aug 25, 2010 at 9:05 AM, Aeterna <[email protected]> wrote: > To give a small update/addition, when I run 'cat /var/ossec/logs/ > alerts/alerts.log | /var/ossec/bin/ossec-reportd -n "Test Summary"' > it's still cat'ing the alerts file directly, the ossec.log just shows > this: > 2010/08/25 14:48:18 ossec-reportd: INFO: Started (pid: 4251). > 2010/08/25 14:48:23 ossec-reportd: INFO: Report 'Test Summary' > completed. Creating output... >
I still don't understand what you mean by "it's still cat'ing the alerts file directly." When you run that command you see the EXACT same output as if you only ran "cat /var/ossec/logs/alerts/alerts.log"? This is the (slightly edited) output I get when I run that command: 2010/08/25 09:35:50 ossec-reportd: INFO: Started (pid: 15504). 2010/08/25 09:35:55 ossec-reportd: INFO: Report 'Test Summary' completed. Creating output... Report 'Test Summary' completed. ------------------------------------------------ ->Processed alerts: 1781 ->Post-filtering alerts: 1781 ->First alert: 2010 Aug 25 00:00:02 ->Last alert: 2010 Aug 25 09:35:25 Top entries for 'Source ip': ------------------------------------------------ 192.168.14.1 |6 | 192.168.3.1 |6 | IPv6:::1 |5 | 192.168.2.1 |1 | 192.168.1.1 |1 | Top entries for 'Username': ------------------------------------------------ SYSTEM |3 | ddp |3 | root |1 | Top entries for 'Level': ------------------------------------------------ Severity 1 |1180 | Severity 3 |496 | Severity 7 |69 | Severity 5 |25 | Severity 6 |9 | Severity 10 |2 | ... If you're not seeing something like that, I suspect there may be something wrong with your ossec-reportd binary. > Also I noticed that with the posted agent.conf which omits /var/log/ > mail.info, my alerts file is rapidly filling up with messages from > that log, which again points to the agent still using the ossec.conf. > I've already issued a restart for the agent from the manager twice, > just to make sure. > Documentation will be updated to make this more clear. > The first server is running on kernel 2.6.18.8, while the 2nd > testserver is running 2.6.29 and both are running Debian Lenny. > >
