> Check the md5 of the files on both systems. Make sure they match up. > And you can "upgrade" ossec over itself. Just run the install.sh and > tell it to upgrade the current install.
I actually decided to check this just after I clicked the Send button unfortunately, they indeed don't match up. And what I did was install a 2nd server to see if it'd behave the same way, I have an agent binary install ready for the actual agents. ;) The idea's to just have 1 server, the 2nd is merely to see the behavior, which I found strange. I just updated the server install and tried the reportd with a test report and it again just cat'd the alerts file. So I reinstalled the server to see if that'll help... but something's clearly interfering. Even after the install the filesize is 212K compared to the (second server's) 206K of the working reportd. > Just remove it from ossec.conf. > You can have a VERY barebones ossec.conf file. This is the complete > ossec.conf on one of my agents: > <ossec_config> > <client> > <server-ip>192.168.1.1</server-ip> > </client> > </ossec_config> > > That's portable enough to be installed on ALL of my agents. That's good news, can simply just echo that into it then, great to know that, perhaps good to point out as well when it comes to updating the documentation. On Aug 25, 4:32 pm, "dan (ddp)" <[email protected]> wrote: > On Wed, Aug 25, 2010 at 10:08 AM, Aeterna <[email protected]> wrote: > >> When you run that command you see the EXACT same output as if you only > >> ran "cat /var/ossec/logs/alerts/alerts.log"? > > > That's exactly what it shows, the 2nd test server shows a report as > > you posted. > > > The mails I got as a daily report showed this as subject: > > "Daily report: syscheck Report 'Daily report: syscheck' completed. > > ------------------------------------------------ ->Processed alerts: > > 7521 ->Post-filtering alerts: 2 ->First alert: 2010 Aug 24 12:38:07 - > >>Last alert: 2010 Aug 24 17:13:33 Top entries for 'Level': > > ------------------------------------------------ Severity 7 |2 | Top > > entries for 'Group': ------------------------------------------------ > > ossec |2 | syscheck |2 | Top entries for 'Location': > > ------------------------------------------------ (agent.hostname) > > 192.168.176.190->syscheck |2 | Top entries for 'Rule': > > ------------------------------------------------ 550 - Integrity > > checksum changed. |1 | 551 - Integrity checksum changed again (2nd .. | > > 1 |" > > > So it would indeed seem that my reportd is not functioning properly, > > what'd you say is the best way to replace it? Reinstall ossec manager > > completely, or can this be done otherwise.? > > Check the md5 of the files on both systems. Make sure they match up. > And you can "upgrade" ossec over itself. Just run the install.sh and > tell it to upgrade the current install. > > I'm scatterbrained today, so excuse the possibly stupid questions. > Did you do the server install on both systems? > Did you intend to have 2 OSSEC servers, or are you using one as an agent? > - Agents don't have reportd or alerts.log > > If you're not planning on having 2 OSSEC server installs, you'll need > to compile the binaries for the agent install. > > > Related to the agent.conf, i guess the only way to omit a certain > > logfile from being logged is removing it from the ossec.conf on every > > agent or is there another way to do this? > > Just remove it from ossec.conf. > You can have a VERY barebones ossec.conf file. This is the complete > ossec.conf on one of my agents: > <ossec_config> > <client> > <server-ip>192.168.1.1</server-ip> > </client> > </ossec_config> > > That's portable enough to be installed on ALL of my agents.
