On 11/23/2010 12:19 PM, [email protected] wrote: > I'm new to ossec, but after installing it on fedora 9 x64, it doesn't > seem to do much. I enabled "debug" mode, but get errors from log > collector: > > 2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file: > '/var/log/maillog'. > 2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file: > '/var/log/httpd/error_log'. > 2010/11/23 11:51:04 ossec-logcollector(1950): INFO: Analyzing file: > '/var/log/httpd/access_log'. > 2010/11/23 11:51:04 ossec-logcollector: INFO: Started (pid: 11532). > 2010/11/23 11:51:10 ossec-logcollector: socketerr (not available). > 2010/11/23 11:51:10 ossec-logcollector(1224): ERROR: Error sending > message to queue. > 2010/11/23 11:51:13 ossec-logcollector(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2010/11/23 11:51:13 ossec-logcollector(1211): ERROR: Unable to access > queue: '/var/ossec/queue/ossec/queue'. Giving up.. > > When I first run ossec-control start, I can see 5 ossec processes: > > root 11633 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-execd -d > ossec 11636 1 1 11:56 ? 00:00:00 > /var/ossec/bin/ossec-analysisd -d > root 11640 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-logcollector -d > root 11644 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-syscheckd -d > ossec 11648 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-monitord -d > > After 20 seconds, only 3 remain: > > root 11633 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-execd -d > root 11644 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-syscheckd -d > ossec 11648 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-monitord -d > > After a minute, only 2 staying running: > > root 11633 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-execd -d > ossec 11648 1 0 11:56 ? 00:00:00 > /var/ossec/bin/ossec-monitord -d > > I have configured a windows agent to report to this server, but I never > see it analyze any logs. On the windows side, I see these logs: > > 2010/11/23 11:51:20 ossec-agent(4101): WARN: Waiting for server reply > (not started). Tried: 'ackbar.netwitness.local/10.21.4.24'. > 2010/11/23 11:51:20 ossec-agent: INFO: Trying next server ip in the > line: '10.21.4.24'. > 2010/11/23 11:51:21 ossec-agent: INFO: Closing connection to server > (10.21.4.24:1514). > 2010/11/23 11:51:21 ossec-agent: INFO: Trying to connect to server > (10.21.4.24:1514). > > I'm at a loss as to how the processes interact and why analysisd doesn't > stay running. What's going on with /var/ossec/queue/ossec/queue? Why > can't my windows agent connect to monitord? There isn't a firewall and > the machine can be pinged without issue. > > Any help would be much appreciated! > > Thanks, > Scott
This may sound silly but I must ask: Is the Windows server allowing the outgoing connections to be made? Make sure your Linux is actually listening: netstat -uan Hope this helps. -- Francisco Neira Basso, ISO 27002 Seguridad de la Informacion ISACA No.565432, IEEE No.90934498 Usuario Linux # 165985 Defensoria del Pueblo
signature.asc
Description: OpenPGP digital signature
