The web server does run as apache. Here's a snippet of the error_log after the restart I just did. The errors just repeat after this. ---------------------------------------------------------------------------------------------------- [Tue Oct 12 14:01:18 2010] [notice] SIGHUP received. Attempting to restart [Tue Oct 12 14:01:18 2010] [notice] Digest: generating secret for digest authentication ... [Tue Oct 12 14:01:18 2010] [notice] Digest: done [Tue Oct 12 14:01:18 2010] [notice] mod_python: Creating 4 session mutexes based on 256 max processes and 0 max threads. [Tue Oct 12 14:01:18 2010] [notice] Apache/2.2.3 (Red Hat) configured -- resuming normal operations [Tue Oct 12 14:01:25 2010] [error] [client] PHP Notice: Undefined variable: g_last_changes in /var/www/html/lib/os_lib_syscheck.php on line 360, referer: http://server/index.php?f=s [Tue Oct 12 14:01:25 2010] [error] [client] PHP Warning: fopen(/var/ossec/logs/alerts/alerts.log) [<a href='function.fopen'>function.fopen</a>]: failed to open stream: No such file or directory in /var/www/html/lib/os_lib_alerts.php on line 814, referer: http://server/index.php?f=s [Tue Oct 12 14:01:27 2010] [error] [client] PHP Notice: Undefined variable: g_last_changes in /var/www/html/lib/os_lib_syscheck.php on line 360, referer: http://server/index.php?f=s [Tue Oct 12 14:01:27 2010] [error] [client PHP Warning: fopen(/var/ossec/logs/alerts/alerts.log) [<a href='function.fopen'>function.fopen</a>]: failed to open stream: No such file or directory in /var/www/html/lib/os_lib_alerts.php on line 814, referer: http://server/index.php?f=s -------------------------------------------------------------------------------------------------
The /var/ossec/logs/alerts/alerts.log doesn't exist. Shouldn't ossec create this though? -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: Tuesday, October 12, 2010 2:24 PM To: [email protected] Subject: Re: [ossec-list] Unable to retrieve alerts. Does apache run as the user apache? If so, you'll have to start looking through the apache logs to see if there is an error related to this. You'd think the webserver would make a log entry when it couldn't access something it was supposed to... On Tue, Oct 12, 2010 at 2:58 PM, Justin Redman <[email protected]> wrote: > I have this line in my /etc/group: > > ossec:x:503:apache > > I did restart the server after I made all the changes. I just restarted it > again to make sure and it is the same. > > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of dan (ddp) > Sent: Tuesday, October 12, 2010 1:36 PM > To: [email protected] > Subject: Re: [ossec-list] Unable to retrieve alerts. > > Are you sure you configured the groups completely? And restarted the > webserver after? If the webserver does not have ossec group > permissions it will not be able to get to the data. > > On Tue, Oct 12, 2010 at 2:26 PM, Justin Redman <[email protected]> > wrote: >> Hi there, >> >> >> >> I just installed the latest OSSEC and the web ui using the server option in >> the install. I followed the instructions found here: >> http://www.ossec.net/wiki/OSSECWUI:Install aside from the last bit about >> re-configuring php. Now when I browse to the web interface I see "Unable to >> retrieve alerts." Below the available agent list. >> >> >> >> Also showing is "No integrity checking information available. Nothing >> reported as changed." >> >> >> >> I have selinux temporarily disabled. >> >> >> >> If anyone can point me in the right direction I'd appreciate it. >> >> >> >> Thanks, >> >> >> >> -Justin >
