Sure I can email a daily report, no problem manually. However the reports don't mention the actual events even when there's only a few. So what when I want to look at the actual events from the previous day? When I look at my /logs/archives/year/month/ directory I see this:
nagios:~# ls -lah /var/ossec/logs/archives/2010/Aug/ total 32K drwxr-x--- 2 ossec ossec 4.0K 2010-08-31 00:03 . drwxr-x--- 3 ossec ossec 4.0K 2010-08-25 17:06 .. -rwxr-x--- 1 ossec ossec 282 2010-08-26 00:02 ossec- archive-25.log.sum -rwxr-x--- 1 ossec ossec 346 2010-08-27 00:00 ossec- archive-26.log.sum -rwxr-x--- 1 ossec ossec 346 2010-08-28 00:01 ossec- archive-27.log.sum -rwxr-x--- 1 ossec ossec 346 2010-08-29 00:00 ossec- archive-28.log.sum -rwxr-x--- 1 ossec ossec 346 2010-08-30 00:01 ossec- archive-29.log.sum -rw-r----- 1 ossec ossec 346 2010-08-31 00:03 ossec- archive-30.log.sum -rw-r----- 2 ossec ossec 0 2010-08-31 00:00 ossec-archive-31.log However I am confused about this since if I run: zcat /var/ossec/logs/alerts/2010/Aug/*.gz | /var/ossec/bin/ossec- reportd I'll get a full report full with the archived messages. So clearly you can't view them as root but how can I best view the events from the manager then? On Aug 30, 4:23 pm, "dan (ddp)" <[email protected]> wrote: > I'm not aware of a setting to email an empty report. You could setup a > cron job to do the same thing though. > > On Mon, Aug 30, 2010 at 10:00 AM, Aeterna <[email protected]> wrote: > > To give an update, I was unaware that the server was running Debian 4/ > > etch. I had been told it had been updated to 5/lenny a while ago and > > therefore didn't look at it. But I upgraded it today and updated ossec > > along with it and generating a test report atleast works in the CLI > > now. > > > I have been wondering 1 thing however, when there are no alerts post- > > filter(no integrity changes for example) it won't generate an e-mail. > > Is it possible to let it send an e-mail regardless? That way It'd stop > > me from wondering if ossec's still running or not.
