Thanks Daniel! I tried it but it's failing elsewhere now (this time in analysisd it seems):
*** Making analysisd *** make[1]: Entering directory `/home/jlee/ossec-hids-101202/src/ analysisd' cd ./cdb; make make[2]: Entering directory `/home/jlee/ossec-hids-101202/src/ analysisd/cdb' gcc -I../ -g -Wall -I../../ -I../../headers -DDEFAULTDIR=\"/var/ossec \" -DCLIENT -DUSE_OPENSSL -DARGV0=\"cdb\" -DXML_VAR=\"var\" - DOSSECHIDS -c cdb.c cdb_hash.c cdb_make.c uint32_pack.c uint32_unpack.c ar cru cdb.a cdb.o cdb_hash.o cdb_make.o uint32_pack.o uint32_unpack.o ar cru cdb_make.a cdb.o cdb_hash.o cdb_make.o uint32_pack.o uint32_unpack.o ranlib cdb.a ranlib cdb_make.a make[2]: Leaving directory `/home/jlee/ossec-hids-101202/src/analysisd/ cdb' cd ./alerts; make make[2]: Entering directory `/home/jlee/ossec-hids-101202/src/ analysisd/alerts' gcc -I../ -g -Wall -I../../ -I../../headers -DDEFAULTDIR=\"/var/ossec \" -DCLIENT -DUSE_OPENSSL -DARGV0=\"alerts\" -DXML_VAR=\"var\" - DOSSECHIDS -c mail.c log.c exec.c getloglocation.c ar cru alerts.a mail.o log.o exec.o getloglocation.o ranlib alerts.a make[2]: Leaving directory `/home/jlee/ossec-hids-101202/src/analysisd/ alerts' cd ./decoders; make make[2]: Entering directory `/home/jlee/ossec-hids-101202/src/ analysisd/decoders' cd plugins; make; make[3]: Entering directory `/home/jlee/ossec-hids-101202/src/ analysisd/decoders/plugins' gcc -g -Wall -I../../../ -I../../../headers -DDEFAULTDIR=\"/var/ossec \" -DCLIENT -DUSE_OPENSSL -DARGV0=\"ossec-analysisd\" -DXML_VAR= \"var\" -DOSSECHIDS -I../../ -c *.c make[3]: Leaving directory `/home/jlee/ossec-hids-101202/src/analysisd/ decoders/plugins' gcc -g -Wall -I../../ -I../../headers -DDEFAULTDIR=\"/var/ossec\" - DCLIENT -DUSE_OPENSSL -DARGV0=\"ossec-analysisd\" -DXML_VAR=\"var \" -DOSSECHIDS -I../ -c *.c decode-xml.c: In function `ReadDecodeXML': decode-xml.c:199: parse error before `xml' decode-xml.c:224: `i' undeclared (first use in this function) decode-xml.c:224: (Each undeclared identifier is reported only once decode-xml.c:224: for each function it appears in.) decode-xml.c:224: `xml' undeclared (first use in this function) decode-xml.c:245: `node' undeclared (first use in this function) decode-xml.c:259: `NULL_Decoder_tmp' undeclared (first use in this function) decode-xml.c:281: `xml_decoder' undeclared (first use in this function) decode-xml.c:291: `xml_decoder_name' undeclared (first use in this function) decode-xml.c:301: `xml_decoder_status' undeclared (first use in this function) decode-xml.c:382: `xml_parent' undeclared (first use in this function) decode-xml.c:388: `xml_regex' undeclared (first use in this function) decode-xml.c:421: `xml_prematch' undeclared (first use in this function) decode-xml.c:453: `xml_program_name' undeclared (first use in this function) decode-xml.c:459: `xml_ftscomment' undeclared (first use in this function) decode-xml.c:463: `xml_usename' undeclared (first use in this function) decode-xml.c:469: `xml_plugindecoder' undeclared (first use in this function) decode-xml.c:497: `xml_type' undeclared (first use in this function) decode-xml.c:524: `xml_order' undeclared (first use in this function) decode-xml.c:624: `xml_fts' undeclared (first use in this function) make[2]: *** [dc] Error 1 make[2]: Leaving directory `/home/jlee/ossec-hids-101202/src/analysisd/ decoders' make[1]: *** [logaudit] Error 2 make[1]: Leaving directory `/home/jlee/ossec-hids-101202/src/ analysisd' Error Making analysisd make: *** [all] Error 1 Error 0x5. Building error. Unable to finish the installation. Thanks, Jeremy On Dec 2, 4:35 pm, Daniel Cid <[email protected]> wrote: > Oops, fixed on the latest snapshot: > > http://www.ossec.net/files/snapshots/ > > Thanks, > > On Wed, Dec 1, 2010 at 1:54 PM, jplee3 <[email protected]> wrote: > > Yep, same thing with the 11-25 snapshot: > > > *** Making shared *** > > > make[1]: Entering directory `/home/jlee/ossec-hids-101125/src/shared' > > gcc -c -g -Wall -I../ -I../headers -DDEFAULTDIR=\"/var/ossec\" - > > DCLIENT -DUSE_OPENSSL -DARGV0=\"shared-libs\" -DXML_VAR=\"var\" - > > DOSSECHIDS *.c > > read-alert.c: In function `GetAlertData': > > read-alert.c:144: parse error before `char' > > read-alert.c:145: `m' undeclared (first use in this function) > > read-alert.c:145: (Each undeclared identifier is reported only once > > read-alert.c:145: for each function it appears in.) > > read-alert.c:150: parse error before `int' > > read-alert.c:151: `z' undeclared (first use in this function) > > make[1]: *** [shared] Error 1 > > make[1]: Leaving directory `/home/jlee/ossec-hids-101125/src/shared' > > > Error Making shared > > make: *** [all] Error 1 > > > Error 0x5. > > Building error. Unable to finish the installation. > > > This is under kernel version 2.4.20-27.7 > > > On Nov 24, 11:29 pm, Md Monk <[email protected]> wrote: > >> Repent! Repent, and not use Red Hat 7.x! > > >> Lol! Just kidding, and having a bit of fun. My bad. :) > > >> -Chuck > > >> Sent from my iPwn > > >> On Nov 24, 2010, at 7:40 PM, Michael Starks <[email protected]> > >> wrote: > > >> > On 11/24/2010 04:35 PM, Justin Mitchell wrote: > >> >> I had ossec 2.4.1 installed on three servers (redhat 7.1, redhat 7.2, > >> >> and centos 4.8). I ran the update on all three servers, and only had > >> >> success with the centos 4.8 server. On the two redhat 7.x servers, it > >> >> failed with the following error: > > >> > OSSEC is punishing you for using Red Hat 7.x. :) > > >> > -- > >> > Michael Starks > >> > [I] Immutable Security > >> >http://www.immutablesecurity.com
