Hi Jason, Are you sure the stats aren't being printed and fly off the screen? Try redirecting stderr: cat /var/ossec/logs/alerts/alerts.log | ./ossec-reportd -n "Daily report" 2>&1 | more
The above works for me. On Wed, Jan 26, 2011 at 4:15 PM, Youngquist, Jason R. <[email protected]> wrote: > I'm able to successfully generate reports with ossec-reportd, but only if I > use the -f flag. > > > > > > Ie. this works as advertised. > > cat /var/ossec/logs/alerts/alerts.log | ./ossec-reportd -n "Logins summary" > -f group authentication_success > > > > > > 2011/01/26 15:13:13 ossec-reportd: INFO: Report 'Logins summary' completed. > Creating output... > > > > Report 'Logins summary' completed. > > ------------------------------------------------ > > ->Processed alerts: 679 > > ->Post-filtering alerts: 2 > > ->First alert: 2011 Jan 26 10:30:17 > > ->Last alert: 2011 Jan 26 10:30:17 > > > > > > Top entries for 'Source ip': > > ------------------------------------------------ > > 10.10.30.176 |1 | > > [snip] > > > > > > > > > > But what I'm looking for is a more generic summary report without the > filtering ie. > > cat /var/ossec/logs/alerts/alerts.log | ./ossec-reportd -n "Daily Summary" > > > > and when execute this, instead of receiving a summary of the alerts, it just > dumps out a list of the alerts.log file. I'm referencing this URL here, > which shows that without the -f flag, ossec-reportd should dump out a > summary of the alerts - > http://www.ossec.net/main/manual/manual-reporting-tool/ > > > > Thoughts? > > > > > > Thanks. > > Jason Youngquist > > Information Technology Security Engineer > > Technology Services > > Columbia College > > 1001 Rogers Street, Columbia, MO 65216 > > (573) 875-7334 > > [email protected] > > http://www.ccis.edu > > > > > > > >
