I'm new to ossec, but after installing it on fedora 9 x64, it doesn't
seem to do much. I enabled "debug" mode, but get errors from log
collector:
2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file:
'/var/log/maillog'.
2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file:
'/var/log/httpd/error_log'.
2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file:
'/var/log/httpd/access_log'.
2010/11/23 11:51:04 ossec-logcollector: INFO: Started (pid: 11532).
2010/11/23 11:51:10 ossec-logcollector: socketerr (not available).
2010/11/23 11:51:10 ossec-logcollector(1224): ERROR: Error sending
message to queue.
2010/11/23 11:51:13 ossec-logcollector(1210): ERROR: Queue
'/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2010/11/23 11:51:13 ossec-logcollector(1211): ERROR: Unable to access
queue: '/var/ossec/queue/ossec/queue'. Giving up..
When I first run ossec-control start, I can see 5 ossec processes:
root 11633 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-execd -d
ossec 11636 1 1 11:56 ? 00:00:00
/var/ossec/bin/ossec-analysisd -d
root 11640 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-logcollector -d
root 11644 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-syscheckd -d
ossec 11648 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-monitord -d
After 20 seconds, only 3 remain:
root 11633 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-execd -d
root 11644 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-syscheckd -d
ossec 11648 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-monitord -d
After a minute, only 2 staying running:
root 11633 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-execd -d
ossec 11648 1 0 11:56 ? 00:00:00
/var/ossec/bin/ossec-monitord -d
I have configured a windows agent to report to this server, but I never
see it analyze any logs. On the windows side, I see these logs:
2010/11/23 11:51:20 ossec-agent(4101): WARN: Waiting for server reply
(not started). Tried: 'ackbar.netwitness.local/10.21.4.24'.
2010/11/23 11:51:20 ossec-agent: INFO: Trying next server ip in the
line: '10.21.4.24'.
2010/11/23 11:51:21 ossec-agent: INFO: Closing connection to server
(10.21.4.24:1514).
2010/11/23 11:51:21 ossec-agent: INFO: Trying to connect to server
(10.21.4.24:1514).
I'm at a loss as to how the processes interact and why analysisd doesn't
stay running. What's going on with /var/ossec/queue/ossec/queue? Why
can't my windows agent connect to monitord? There isn't a firewall and
the machine can be pinged without issue.
Any help would be much appreciated!
Thanks,
Scott
