On Oct 25, 5:46 am, "dan (ddp)" <[email protected]> wrote:
> On Mon, Oct 25, 2010 at 12:43 AM, x509v3 <[email protected]> wrote:
> > I just upgraded a test infrastructure from 2.4 to 2.5.1. I upgraded
> > the server first, then my one test agent.
>
> > The startup of both the server and agent looked good, but at soon as I
> > run syscheck_update, my ossec.log start filling up with the following
> > messages.
>
> > I've stopped both server and agent, no joy. If I can't update the
> > database, I'm not sure how to fix this. The analysisd webpage is
> > empty, so I'm not even sure where to start troubleshooting. I couldn't
> > find any obvious "database" to nuke and just start over.
>
> > I'm looking for any pointers or hints.
>
> > thanks.
>
> > [r...@server bin]# ./syscheck_update -a
>
> > ** Integrity check database updated.
>
> > [r...@server bin]# 2010/10/24 21:39:38 ossec-analysisd: Invalid
> > integrity message in the database.
> > 2010/10/24 21:39:38 ossec-analysisd: Invalid integrity message in the
> > database.
> > 2010/10/24 21:39:38 ossec-analysisd: Invalid integrity message in the
> > database.
> > 2010/10/24 21:39:38 ossec-analysisd: Invalid integrity message in the
> > database.
> > ... repeats a gazillion times
>
> The databases are in /var/ossec/queue/syscheck
> I'd copy them somewhere else and run "/var/ossec/bin/syscheck_control
> -u <agent_id>" to clear the database. Then try again. It might be
> interesting to see what's in the current database, maybe find out why
> it's "invalid."
Thanks for the pointer, Dan. I tried the "-u" option and "-u all"
option, but wasn't getting any resolution. I ended up nuking the old
setup and starting over, which wasn't a problem for this test
infrastructure...plus, I knew you or someone would come back with info
on better troubleshooting. :)
The /var/ossec/queue/syscheck/syscheck file from the old version had a
completely wonky header in it, visible only from "vi" or "more", but
not from "cat or head" which is probably how I missed it before. To
anyone else who runs across this error in the future: view the
syscheck file with a binary-sensitive file editor/viewer to look for
otherwise hidden corruption.
Here's a sample, note the binary nulls at the beginning of the
corrupted file. Because they're nulls, they didn't show up when
running "cat" or "head".
[Correctly formatted file:]
[r...@server syscheck]# head /var/ossec/queue/syscheck/syscheck
+++24:33188:0:0:cf2c3e166bc1c5ea6266fff5ef05c86e:
249598bc655b63d1ad1dabe597483d60fc9d4d07 !1287984337 /etc/
NetworkManager/nm-system-settings.conf
++
+205604:33188:0:0:8e1939e94c642de4030aaed6ec580020:7c2a6c1ae4d8cefd7d5b054e7d00f66fdd3c7655
!
1287984337 /etc/readahead.d/default.later
++
+25023:33188:0:0:b9833699d126eb5ff661ef3528339fd3:59603ee3305b65293e3264fd53eeef7b5c0837ad
!
1287984337 /etc/readahead.d/default.early
++
+322:33188:0:0:a40ea9d99ad8722587eedcc237b10a89:98a5fe29237c74ec9d5d63632d86dbbfc8441199
!
1287984337 /etc/pam.d/gnome-screensaver
+++1170:33261:0:0:63f4508e471cb30d1d2620e96d0915ed:
1170e372ff4210f51451863961d0ea2f27f985cd !1287984337 /etc/pam.d/system-
auth-bak
++
+157:33188:0:0:293f457c7683f5174171d53440db6e94:5145c186f9fc7ac15ce5ffe8cb07fa5d50c00e28
!
1287984337 /etc/pam.d/dovecot
++
+125:33188:0:0:da2897968d27ebc135d2a860156595ee:c70a72d7d7cb1f01b5a243afec6aa12c2d0e5b65
!
1287984337 /etc/pam.d/cpufreq-selector
++
+147:33188:0:0:2e34bf59ff292b2e03a0701a865881cf:cb67b154a9194e41c3176089c755ed9c694a863f
!
1287984337 /etc/pam.d/halt
++
+58:41471:0:0:51fc87a657acce1ce39cea493cd68f10:cc5fde6fd4993243900386abcd64eaeba28e42c5
!
1287984337 /etc/pam.d/vmware-guestd
+++143:33188:0:0:b8b44b045259525e0fae9e38fdb2aeeb:
5eee0c00c9193b8cfc26a85605a4a10727844295 !1287984337 /etc/pam.d/
runuser
[r...@server]# od -cx /var/ossec/queue/syscheck/syscheck | head
0000000 + + + 2 4 : 3 3 1 8 8 : 0 :
0 :
2b2b 322b 3a34 3333 3831 3a38 3a30 3a30
0000020 c f 2 c 3 e 1 6 6 b c 1 c 5 e
a
6663 6332 6533 3631 6236 3163 3563 6165
0000040 6 2 6 6 f f f 5 e f 0 5 c 8 6
e
3236 3636 6666 3566 6665 3530 3863 6536
0000060 : 2 4 9 5 9 8 b c 6 5 5 b 6 3
d
323a 3934 3935 6238 3663 3535 3662 6433
0000100 1 a d 1 d a b e 5 9 7 4 8 3 d
6
6131 3164 6164 6562 3935 3437 3338 3664
[Corrupted file:]
[r...@server syscheck]# head /var/ossec.bad/queue/syscheck/syscheck
++
+6:41471:0:0:bde455ab1aaf1f1a7b1830eb100ce0e9:db87f75999d45e456c3dc3ab790aa1645b4b4698
!
1287983685 /usr/bin/mlabel
++
+51584:33261:0:0:8eb75801e96ea2d95455147a5225ed06:01bd2e1492b712baca2e7957bda82aaabdb10130
!
1287983687 /usr/bin/xconsole
++
+8536:33261:0:0:4c55dc2c7bb75667176ff9309b20903d:dbae187bf5e62487583805fc8d6fc72024262faa
!
1287983687 /usr/bin/setsid
++
+13:41471:0:0:4213d51b526354cc1fd897029c14c667:7a5014933a02fa5b24e536232e6ff3e74664dedc
!
1287983687 /usr/bin/system-config-display
++
+13096:33261:0:0:5c618861c56689af44613404616c73f8:436ba83a94d7093fc285f325e795e98619d9e446
!
1287983687 /usr/bin/chattr
+++264:33261:0:0:fe404a7ebdb656d6cdbc3d571851fadb:
16e59dfefd0c6c3358a887f2985e6243470d4e24 !1287983687 /usr/bin/ps2pdf14
+++12000:33261:0:0:927903f0c59f9caff140303c3c27765b:
23baa1252308d6ab808c30492eccf4ede78ddafa !1287983687 /usr/bin/setleds
++
+22688:33261:0:0:6e7dc5288116d83081158b49cb74b766:d866d886d8af975125bbee843f1db44e7e294239
!
1287983687 /usr/bin/nm-tool
+++7632:33261:0:0:213a68015fbef499c3901f994d43aa9e:
7e797abda456cc92cd4dc6e0cc9400e8e2e910bc !1287983687 /usr/bin/
mysql_config
++
+12040:33261:0:0:c25cfb6d0e3331f50460926605c6a55f:e2dfdd9b7f631e900adc6c2875a8e53915d0beb6
!
1287983687 /usr/bin/irkbd
[r...@server: syscheck]# od -cx /var/ossec.bad/queue/syscheck/syscheck
| head
0000000 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0
\0
0000 0000 0000 0000 0000 0000 0000 0000
*
0736660 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 + +
+
0000 0000 0000 0000 0000 0000 2b00 2b2b
0736700 6 : 4 1 4 7 1 : 0 : 0 : b d e
4
3a36 3134 3734 3a31 3a30 3a30 6462 3465
0736720 5 5 a b 1 a a f 1 f 1 a 7 b 1
8
3535 6261 6131 6661 6631 6131 6237 3831
0736740 3 0 e b 1 0 0 c e 0 e 9 : d b
8
