To give an update, I was unaware that the server was running Debian 4/ etch. I had been told it had been updated to 5/lenny a while ago and therefore didn't look at it. But I upgraded it today and updated ossec along with it and generating a test report atleast works in the CLI now.
I have been wondering 1 thing however, when there are no alerts post- filter(no integrity changes for example) it won't generate an e-mail. Is it possible to let it send an e-mail regardless? That way It'd stop me from wondering if ossec's still running or not. On Aug 25, 5:18 pm, Aeterna <[email protected]> wrote: > > Check the md5 of the files on both systems. Make sure they match up. > > And you can "upgrade" ossec over itself. Just run the install.sh and > > tell it to upgrade the current install. > > I actually decided to check this just after I clicked the Send button > unfortunately, they indeed don't match up. > > And what I did was install a 2nd server to see if it'd behave the same > way, I have an agent binary install ready for the actual agents. ;) > The idea's to just have 1 server, the 2nd is merely to see the > behavior, which I found strange. > > I just updated the server install and tried the reportd with a test > report and it again just cat'd the alerts file. > So I reinstalled the server to see if that'll help... but something's > clearly interfering. Even after the install the filesize is 212K > compared to the (second server's) 206K of the working reportd. > > > Just remove it from ossec.conf. > > You can have a VERY barebones ossec.conf file. This is the complete > > ossec.conf on one of my agents: > > <ossec_config> > > <client> > > <server-ip>192.168.1.1</server-ip> > > </client> > > </ossec_config> > > > That's portable enough to be installed on ALL of my agents. > > That's good news, can simply just echo that into it then, great to > know that, perhaps good to point out as well when it comes to updating > the documentation. > > On Aug 25, 4:32 pm, "dan (ddp)" <[email protected]> wrote: > > > On Wed, Aug 25, 2010 at 10:08 AM, Aeterna <[email protected]> wrote: > > >> When you run that command you see the EXACT same output as if you only > > >> ran "cat /var/ossec/logs/alerts/alerts.log"? > > > > That's exactly what it shows, the 2nd test server shows a report as > > > you posted. > > > > The mails I got as a daily report showed this as subject: > > > "Daily report: syscheck Report 'Daily report: syscheck' completed. > > > ------------------------------------------------ ->Processed alerts: > > > 7521 ->Post-filtering alerts: 2 ->First alert: 2010 Aug 24 12:38:07 - > > >>Last alert: 2010 Aug 24 17:13:33 Top entries for 'Level': > > > ------------------------------------------------ Severity 7 |2 | Top > > > entries for 'Group': ------------------------------------------------ > > > ossec |2 | syscheck |2 | Top entries for 'Location': > > > ------------------------------------------------ (agent.hostname) > > > 192.168.176.190->syscheck |2 | Top entries for 'Rule': > > > ------------------------------------------------ 550 - Integrity > > > checksum changed. |1 | 551 - Integrity checksum changed again (2nd .. | > > > 1 |" > > > > So it would indeed seem that my reportd is not functioning properly, > > > what'd you say is the best way to replace it? Reinstall ossec manager > > > completely, or can this be done otherwise.? > > > Check the md5 of the files on both systems. Make sure they match up. > > And you can "upgrade" ossec over itself. Just run the install.sh and > > tell it to upgrade the current install. > > > I'm scatterbrained today, so excuse the possibly stupid questions. > > Did you do the server install on both systems? > > Did you intend to have 2 OSSEC servers, or are you using one as an agent? > > - Agents don't have reportd or alerts.log > > > If you're not planning on having 2 OSSEC server installs, you'll need > > to compile the binaries for the agent install. > > > > Related to the agent.conf, i guess the only way to omit a certain > > > logfile from being logged is removing it from the ossec.conf on every > > > agent or is there another way to do this? > > > Just remove it from ossec.conf. > > You can have a VERY barebones ossec.conf file. This is the complete > > ossec.conf on one of my agents: > > <ossec_config> > > <client> > > <server-ip>192.168.1.1</server-ip> > > </client> > > </ossec_config> > > > That's portable enough to be installed on ALL of my agents.
