> When you run that command you see the EXACT same output as if you only > ran "cat /var/ossec/logs/alerts/alerts.log"?
That's exactly what it shows, the 2nd test server shows a report as you posted. The mails I got as a daily report showed this as subject: "Daily report: syscheck Report 'Daily report: syscheck' completed. ------------------------------------------------ ->Processed alerts: 7521 ->Post-filtering alerts: 2 ->First alert: 2010 Aug 24 12:38:07 - >Last alert: 2010 Aug 24 17:13:33 Top entries for 'Level': ------------------------------------------------ Severity 7 |2 | Top entries for 'Group': ------------------------------------------------ ossec |2 | syscheck |2 | Top entries for 'Location': ------------------------------------------------ (agent.hostname) 192.168.176.190->syscheck |2 | Top entries for 'Rule': ------------------------------------------------ 550 - Integrity checksum changed. |1 | 551 - Integrity checksum changed again (2nd .. | 1 |" So it would indeed seem that my reportd is not functioning properly, what'd you say is the best way to replace it? Reinstall ossec manager completely, or can this be done otherwise.? Related to the agent.conf, i guess the only way to omit a certain logfile from being logged is removing it from the ossec.conf on every agent or is there another way to do this? On Aug 25, 3:38 pm, "dan (ddp)" <[email protected]> wrote: > On Wed, Aug 25, 2010 at 9:05 AM, Aeterna <[email protected]> wrote: > > To give a small update/addition, when I run 'cat /var/ossec/logs/ > > alerts/alerts.log | /var/ossec/bin/ossec-reportd -n "Test Summary"' > > it's still cat'ing the alerts file directly, the ossec.log just shows > > this: > > 2010/08/25 14:48:18 ossec-reportd: INFO: Started (pid: 4251). > > 2010/08/25 14:48:23 ossec-reportd: INFO: Report 'Test Summary' > > completed. Creating output... > > I still don't understand what you mean by "it's still cat'ing the > alerts file directly." > When you run that command you see the EXACT same output as if you only > ran "cat /var/ossec/logs/alerts/alerts.log"? > > This is the (slightly edited) output I get when I run that command: > 2010/08/25 09:35:50 ossec-reportd: INFO: Started (pid: 15504). > 2010/08/25 09:35:55 ossec-reportd: INFO: Report 'Test Summary' > completed. Creating output... > > Report 'Test Summary' completed. > ------------------------------------------------ > ->Processed alerts: 1781 > ->Post-filtering alerts: 1781 > ->First alert: 2010 Aug 25 00:00:02 > ->Last alert: 2010 Aug 25 09:35:25 > > Top entries for 'Source ip': > ------------------------------------------------ > 192.168.14.1 |6 | > 192.168.3.1 |6 | > IPv6:::1 |5 | > 192.168.2.1 |1 | > 192.168.1.1 |1 | > > Top entries for 'Username': > ------------------------------------------------ > SYSTEM |3 | > ddp |3 | > root |1 | > > Top entries for 'Level': > ------------------------------------------------ > Severity 1 |1180 | > Severity 3 |496 | > Severity 7 |69 | > Severity 5 |25 | > Severity 6 |9 | > Severity 10 |2 | > ... > > If you're not seeing something like that, I suspect there may be > something wrong with your ossec-reportd binary. > > > Also I noticed that with the posted agent.conf which omits /var/log/ > > mail.info, my alerts file is rapidly filling up with messages from > > that log, which again points to the agent still using the ossec.conf. > > I've already issued a restart for the agent from the manager twice, > > just to make sure. > > Documentation will be updated to make this more clear. > > > The first server is running on kernel 2.6.18.8, while the 2nd > > testserver is running 2.6.29 and both are running Debian Lenny.
