On Wed, Aug 25, 2010 at 10:08 AM, Aeterna <[email protected]> wrote:
>> When you run that command you see the EXACT same output as if you only
>> ran "cat /var/ossec/logs/alerts/alerts.log"?
>
> That's exactly what it shows, the 2nd test server shows a report as
> you posted.
>
> The mails I got as a daily report showed this as subject:
> "Daily report: syscheck Report 'Daily report: syscheck' completed.
> ------------------------------------------------ ->Processed alerts:
> 7521 ->Post-filtering alerts: 2 ->First alert: 2010 Aug 24 12:38:07 -
>>Last alert: 2010 Aug 24 17:13:33 Top entries for 'Level':
> ------------------------------------------------ Severity 7 |2 | Top
> entries for 'Group': ------------------------------------------------
> ossec |2 | syscheck |2 | Top entries for 'Location':
> ------------------------------------------------ (agent.hostname)
> 192.168.176.190->syscheck |2 | Top entries for 'Rule':
> ------------------------------------------------ 550 - Integrity
> checksum changed. |1 | 551 - Integrity checksum changed again (2nd .. |
> 1 |"
>
> So it would indeed seem that my reportd is not functioning properly,
> what'd you say is the best way to replace it? Reinstall ossec manager
> completely, or can this be done otherwise.?
>
Check the md5 of the files on both systems. Make sure they match up.
And you can "upgrade" ossec over itself. Just run the install.sh and
tell it to upgrade the current install.
I'm scatterbrained today, so excuse the possibly stupid questions.
Did you do the server install on both systems?
Did you intend to have 2 OSSEC servers, or are you using one as an agent?
- Agents don't have reportd or alerts.log
If you're not planning on having 2 OSSEC server installs, you'll need
to compile the binaries for the agent install.
> Related to the agent.conf, i guess the only way to omit a certain
> logfile from being logged is removing it from the ossec.conf on every
> agent or is there another way to do this?
>
>
>
Just remove it from ossec.conf.
You can have a VERY barebones ossec.conf file. This is the complete
ossec.conf on one of my agents:
<ossec_config>
<client>
<server-ip>192.168.1.1</server-ip>
</client>
</ossec_config>
That's portable enough to be installed on ALL of my agents.
