I'm able to successfully generate reports with ossec-reportd, but only if I use
the -f flag.
Ie. this works as advertised.
cat /var/ossec/logs/alerts/alerts.log | ./ossec-reportd -n "Logins summary" -f
group authentication_success
2011/01/26 15:13:13 ossec-reportd: INFO: Report 'Logins summary' completed.
Creating output...
Report 'Logins summary' completed.
------------------------------------------------
->Processed alerts: 679
->Post-filtering alerts: 2
->First alert: 2011 Jan 26 10:30:17
->Last alert: 2011 Jan 26 10:30:17
Top entries for 'Source ip':
------------------------------------------------
10.10.30.176 |1 |
[snip]
But what I'm looking for is a more generic summary report without the filtering
ie.
cat /var/ossec/logs/alerts/alerts.log | ./ossec-reportd -n "Daily Summary"
and when execute this, instead of receiving a summary of the alerts, it just
dumps out a list of the alerts.log file. I'm referencing this URL here, which
shows that without the -f flag, ossec-reportd should dump out a summary of the
alerts - http://www.ossec.net/main/manual/manual-reporting-tool/
Thoughts?
Thanks.
Jason Youngquist
Information Technology Security Engineer
Technology Services
Columbia College
1001 Rogers Street, Columbia, MO 65216
(573) 875-7334
[email protected]
http://www.ccis.edu
