On Tue, Nov 23, 2010 at 12:08 PM, <[email protected]> wrote: > I'm new to ossec, but after installing it on fedora 9 x64, it doesn't seem > to do much. I enabled "debug" mode, but get errors from log collector: > > 2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file: > '/var/log/maillog'. > 2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file: > '/var/log/httpd/error_log'. > 2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file: > '/var/log/httpd/access_log'. > 2010/11/23 11:51:04 ossec-logcollector: INFO: Started (pid: 11532). > 2010/11/23 11:51:10 ossec-logcollector: socketerr (not available). > 2010/11/23 11:51:10 ossec-logcollector(1224): ERROR: Error sending message > to queue. > 2010/11/23 11:51:13 ossec-logcollector(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2010/11/23 11:51:13 ossec-logcollector(1211): ERROR: Unable to access queue: > '/var/ossec/queue/ossec/queue'. Giving up.. >
Make sure /var/ossec/queue/ossec exists. Did you change anything in ossec.conf? Run "/var/ossec/bin/ossec-logtest -t" > When I first run ossec-control start, I can see 5 ossec processes: > > root 11633 1 0 11:56 ? 00:00:00 /var/ossec/bin/ossec-execd > -d > ossec 11636 1 1 11:56 ? 00:00:00 > /var/ossec/bin/ossec-analysisd -d > root 11640 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-logcollector -d > root 11644 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-syscheckd -d > ossec 11648 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-monitord -d > > After 20 seconds, only 3 remain: > > root 11633 1 0 11:56 ? 00:00:00 /var/ossec/bin/ossec-execd > -d > root 11644 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-syscheckd -d > ossec 11648 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-monitord -d > > After a minute, only 2 staying running: > > root 11633 1 0 11:56 ? 00:00:00 /var/ossec/bin/ossec-execd > -d > ossec 11648 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-monitord -d > > I have configured a windows agent to report to this server, but I never see > it analyze any logs. On the windows side, I see these logs: > > 2010/11/23 11:51:20 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: 'ackbar.netwitness.local/10.21.4.24'. > 2010/11/23 11:51:20 ossec-agent: INFO: Trying next server ip in the line: > '10.21.4.24'. > 2010/11/23 11:51:21 ossec-agent: INFO: Closing connection to server > (10.21.4.24:1514). > 2010/11/23 11:51:21 ossec-agent: INFO: Trying to connect to server > (10.21.4.24:1514). > > I'm at a loss as to how the processes interact and why analysisd doesn't > stay running. What's going on with /var/ossec/queue/ossec/queue? Why can't > my windows agent connect to monitord? There isn't a firewall and the > machine can be pinged without issue. > > Any help would be much appreciated! > > Thanks, > Scott >
