Sorry I forgot to mention that you will need to look in archive.log for the logall output.
On 2010-11-03 1:19 PM, "Tim Eberhard" <[email protected]> wrote: So changing it to logall and then changing a start up item via chkconfig..I don't see anything. Nothing in my alerts about it being changed either. My log file is below. Does the syscheckd error matter in this case? r...@ossec:/var/ossec/logs# tail -f ossec.log 2010/11/03 09:56:56 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/nmap-out-bird.log'. 2010/11/03 09:56:56 ossec-logcollector: INFO: Monitoring full output of command(360): netstat -tan |grep LISTEN | grep -v '127.0.0.1' 2010/11/03 09:56:56 ossec-logcollector: INFO: Monitoring full output of command(360): awk -F: '($3 == "0") {print}' /etc/passwd 2010/11/03 09:56:56 ossec-logcollector: INFO: Monitoring full output of command(360): rpm -qa 2010/11/03 09:56:56 ossec-logcollector: INFO: Monitoring full output of command(360): awk -F: '($2 == "") {print}' /etc/shadow 2010/11/03 09:56:56 ossec-logcollector: INFO: Monitoring full output of command(360): find / -user root -perm -4000 -print 2010/11/03 09:56:56 ossec-logcollector: INFO: Started (pid: 23635). 2010/11/03 09:56:56 ossec-analysisd(1210): ERROR: Queue '/queue/alerts/ar' not accessible: 'Connection refused'. 2010/11/03 09:56:56 ossec-analysisd(1301): ERROR: Unable to connect to active response queue. 2010/11/03 09:56:56 ossec-analysisd: INFO: Connected to '/queue/alerts/execq' (exec queue) 2010/11/03 09:57:57 ossec-syscheckd: INFO: Starting syscheck scan (forwarding database). 2010/11/03 09:57:57 ossec-syscheckd: INFO: Starting syscheck database (pre-scan). 2010/11/03 09:57:57 ossec-syscheckd: INFO: Initializing real time file monitoring (not started). 2010/11/03 09:59:34 ossec-syscheckd: ERROR: Invalid internal state (missing '/etc/alternatives/jaxp_parser_impl'). 2010/11/03 10:01:27 ossec-syscheckd: INFO: Finished creating syscheck database (pre-scan completed). 2010/11/03 10:01:39 ossec-syscheckd: INFO: Ending syscheck scan (forwarding database). 2010/11/03 10:01:59 ossec-syscheckd: INFO: Starting real time file monitoring. 2010/11/03 10:01:59 ossec-rootcheck: INFO: Starting rootcheck scan. On Wed, Nov 3, 2010 at 11:40 AM, dan (ddp) <[email protected]> wrote: > Nothing that I can see. Even...
