That's how it sits today. I'll remove them and see if that helps things at all.



On Tue, Nov 2, 2010 at 3:23 PM, dan (ddp) <[email protected]> wrote:
> On Tue, Nov 2, 2010 at 4:13 PM, Tim Eberhard <[email protected]> wrote:
>> [My apologies for posting this to ossec-dev. I typed in the wrong
>> google group. This was intended for ossec-list]
>>
>> All,
>>
>> I've been trying to write some rules for my lab OSSEC box and test
>> them before we roll OSSEC out to production. I'm having some problems
>> writing rules when using the full command. I've tried to follow the
>> examples written here:
>> http://www.ossec.net/doc/manual/monitoring/process-monitoring.html
>>
>> But it seems all my added checks/rules don't work properly.
>>
>> Basic info:
>> -Linux - 2.6.18-128.1.6.el5
>> -OSSEC 2.5.1
>> -Stand alone server
>>
>> Here is the example rule I've been trying to get to work...
>>
>> Check for changes to the system start up services
>> ossec.conf:
>>  <localfile>
>>  <log_format>full_command</log_format>
>>  <command> /sbin/chkconfig  --list | grep '3:on'</command>
>
> Is the space in the <command> above intentional or a paste-o? I don't
> know if it will affect the output or not...
>
>>  </localfile>
>>
>> In local_rules.xml:
>>  <rule id="510004" level="7">
>>  <if_sid>530</if_sid>
>>  <match>ossec: output: ‘/sbin/chkconfig </match>
>>  <check_diff />
>>  <description>The system start up services have changed</description>
>>  </rule>
>>
>>
>> Upon changing the start up and removing an item I get an alert when
>> OSSEC notices the start up script file change..It just doesn't seem to
>> fire off my alert that I have configured.
>>
>> OSSEC HIDS Notification.
>> 2010 Nov 02 07:16:40
>> Received From: ossec->syscheck
>> Rule: 553 fired (level 7) -> "File deleted. Unable to retrieve checksum."
>> Portion of the log(s):
>>
>> File '/etc/rc.d/rc0.d/K03yum-updatesd' was deleted. Unable to retrieve 
>> checksum.
>> --END OF NOTIFICATION
>>
>>
>> Anyone care to tell me what obvious item I'm missing? This holds true
>> for half a dozen items that I am using full_command for and trying to
>> check. Another example is below:
>>
>>
>> Check for changes to the SUID binaries
>> ossec.conf:
>>  <localfile>
>>  <log_format>full_command</log_format>
>>  <command> find / -user root -perm -4000 -print</command>
>>  </localfile>
>>
>> In local_rules.xml:
>>  <rule id="510005" level="7">
>>  <if_sid>530</if_sid>
>>  <match>ossec: output: ‘find / -user root </match>
>>  <check_diff />
>>  <description>SUID root binaries have been changed</description>
>>  </rule>
>>
>>
>> Thanks for any assistance/input you can provide.
>> -Tim Eberhard
>>
>

Reply via email to