Hey Tim, Here are a couple more suggestions based on previously discussed issues around command about monitoring:
-You could try enabling "logall" in ossec.conf to make sure the command output is getting into ossec <global> <logall>yes</logall> </global> -Check if the last entry file is being created Commnd output last entries are stored under /var/ossec/queue/diff/<hostname>/<rule number>/ I tested your chkconfig example and it's working fine here. Cheers, Dale On Wed, Nov 3, 2010 at 10:59 AM, Tim Eberhard <[email protected]> wrote: > I removed that extra white space and it doesn't appear to have helped > anything. Checking the log file.. > > 2010/11/03 07:54:23 ossec-logcollector: INFO: Monitoring full output > of command(360): netstat -tan |grep LISTEN | grep -v$ > 2010/11/03 07:54:23 ossec-logcollector: INFO: Monitoring full output > of command(360): awk -F: '($3 == "0") {print}' /etc/$ > 2010/11/03 07:54:23 ossec-logcollector: INFO: Monitoring full output > of command(360): rpm -qa > 2010/11/03 07:54:23 ossec-logcollector: INFO: Monitoring full output > of command(360): awk -F: '($2 == "") {print}' /etc/s$ > 2010/11/03 07:54:23 ossec-logcollector: INFO: Monitoring full output > of command(360): find / -user root -perm -4000 -print > 2010/11/03 07:54:23 ossec-logcollector: INFO: Started (pid: 21501). > > What is the next step in troubleshooting custom rules like this? I > apologize if this is a standard question.. if someone would show me > how to go about this I'll do my best to spoon feed myself :) > > Thanks again for your help, > -Tim Eberhard > > > On Tue, Nov 2, 2010 at 7:57 PM, Tim Eberhard <[email protected]> wrote: >> That's how it sits today. I'll remove them and see if that helps things at >> all. >> >> >> >> On Tue, Nov 2, 2010 at 3:23 PM, dan (ddp) <[email protected]> wrote: >>> On Tue, Nov 2, 2010 at 4:13 PM, Tim Eberhard <[email protected]> wrote: >>>> [My apologies for posting this to ossec-dev. I typed in the wrong >>>> google group. This was intended for ossec-list] >>>> >>>> All, >>>> >>>> I've been trying to write some rules for my lab OSSEC box and test >>>> them before we roll OSSEC out to production. I'm having some problems >>>> writing rules when using the full command. I've tried to follow the >>>> examples written here: >>>> http://www.ossec.net/doc/manual/monitoring/process-monitoring.html >>>> >>>> But it seems all my added checks/rules don't work properly. >>>> >>>> Basic info: >>>> -Linux - 2.6.18-128.1.6.el5 >>>> -OSSEC 2.5.1 >>>> -Stand alone server >>>> >>>> Here is the example rule I've been trying to get to work... >>>> >>>> Check for changes to the system start up services >>>> ossec.conf: >>>> <localfile> >>>> <log_format>full_command</log_format> >>>> <command> /sbin/chkconfig --list | grep '3:on'</command> >>> >>> Is the space in the <command> above intentional or a paste-o? I don't >>> know if it will affect the output or not... >>> >>>> </localfile> >>>> >>>> In local_rules.xml: >>>> <rule id="510004" level="7"> >>>> <if_sid>530</if_sid> >>>> <match>ossec: output: ‘/sbin/chkconfig </match> >>>> <check_diff /> >>>> <description>The system start up services have changed</description> >>>> </rule> >>>> >>>> >>>> Upon changing the start up and removing an item I get an alert when >>>> OSSEC notices the start up script file change..It just doesn't seem to >>>> fire off my alert that I have configured. >>>> >>>> OSSEC HIDS Notification. >>>> 2010 Nov 02 07:16:40 >>>> Received From: ossec->syscheck >>>> Rule: 553 fired (level 7) -> "File deleted. Unable to retrieve checksum." >>>> Portion of the log(s): >>>> >>>> File '/etc/rc.d/rc0.d/K03yum-updatesd' was deleted. Unable to retrieve >>>> checksum. >>>> --END OF NOTIFICATION >>>> >>>> >>>> Anyone care to tell me what obvious item I'm missing? This holds true >>>> for half a dozen items that I am using full_command for and trying to >>>> check. Another example is below: >>>> >>>> >>>> Check for changes to the SUID binaries >>>> ossec.conf: >>>> <localfile> >>>> <log_format>full_command</log_format> >>>> <command> find / -user root -perm -4000 -print</command> >>>> </localfile> >>>> >>>> In local_rules.xml: >>>> <rule id="510005" level="7"> >>>> <if_sid>530</if_sid> >>>> <match>ossec: output: ‘find / -user root </match> >>>> <check_diff /> >>>> <description>SUID root binaries have been changed</description> >>>> </rule> >>>> >>>> >>>> Thanks for any assistance/input you can provide. >>>> -Tim Eberhard >>>> >>> >> >
