Actually I'm now just running the command from cli and mailing it from there. So I'm getting the full report, however let me give an example: cat /var/ossec/logs/alerts/alerts.log | /var/ossec/bin/ossec-reportd - f group syscheck 2>&1 | mail -s "Syscheck report" (email address)
Results in the following mail: 2010/08/31 15:29:59 ossec-reportd: INFO: Started (pid: 13215). 2010/08/31 15:30:04 ossec-reportd: INFO: Report completed. Creating output... Report completed. == ------------------------------------------------ ->Processed alerts: 1529 ->Post-filtering alerts: 8 ->First alert: 2010 Aug 31 11:13:06 ->Last alert: 2010 Aug 31 12:43:03 Top entries for 'Level': ------------------------------------------------ Severity 7 |8 | Top entries for 'Group': ------------------------------------------------ ossec |8 | syscheck |8 | Top entries for 'Location': ------------------------------------------------ nagios->syscheck |8 | Top entries for 'Rule': ------------------------------------------------ 550 - Integrity checksum changed. |5 | 551 - Integrity checksum changed again (2nd .. |3 | However from this I can't tell what files have actually been changed, just that it's happened. For that I'd need to look at the actual (filtered) alerts. The question is how is the (best) way? On Aug 31, 2:54 pm, "dan (ddp)" <[email protected]> wrote: > On Tue, Aug 31, 2010 at 8:43 AM, Aeterna <[email protected]> wrote: > > Sure I can email a daily report, no problem manually. However the > > reports don't mention the actual events even when there's only a few. > > So what when I want to look at the actual events from the previous > > day? When I look at my /logs/archives/year/month/ directory I see > > this: > > > nagios:~# ls -lah /var/ossec/logs/archives/2010/Aug/ > > total 32K > > drwxr-x--- 2 ossec ossec 4.0K 2010-08-31 00:03 . > > drwxr-x--- 3 ossec ossec 4.0K 2010-08-25 17:06 .. > > -rwxr-x--- 1 ossec ossec 282 2010-08-26 00:02 ossec- > > archive-25.log.sum > > -rwxr-x--- 1 ossec ossec 346 2010-08-27 00:00 ossec- > > archive-26.log.sum > > -rwxr-x--- 1 ossec ossec 346 2010-08-28 00:01 ossec- > > archive-27.log.sum > > -rwxr-x--- 1 ossec ossec 346 2010-08-29 00:00 ossec- > > archive-28.log.sum > > -rwxr-x--- 1 ossec ossec 346 2010-08-30 00:01 ossec- > > archive-29.log.sum > > -rw-r----- 1 ossec ossec 346 2010-08-31 00:03 ossec- > > archive-30.log.sum > > -rw-r----- 2 ossec ossec 0 2010-08-31 00:00 ossec-archive-31.log > > > However I am confused about this since if I run: > > zcat /var/ossec/logs/alerts/2010/Aug/*.gz | /var/ossec/bin/ossec- > > reportd > > > I'll get a full report full with the archived messages. So clearly you > > can't view them as root but how can I best view the events from the > > manager then? > > I think the automated reports are supposed to be just a summary, not > the full report. > If you need the full report, running it manually seems to be the way to go.
