thanks all. Yeah i really want to find out what is going on, since i dont want to take the risk of just ignore it.
This a Red Hat 5.X [root@BAI-MW2 bin]# uname -a Linux 2.6.18-194.17.4.el5 #1 SMP Wed Oct 20 13:03:08 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux That said im going to keep looking .. although i'm running out of ideas of where to look. If you have any ideas on how to troubleshoot more deeply please advice. Thanks again. On Feb 16, 6:00 pm, "Castle, Shane" <[email protected]> wrote: > I must say I have to agree with the research suggestion. One of my systems > had a failed opcode message that I probably would not have seen (or noted the > frequency) had it not been for the OSSEC install; turned out there was an > incorrect BIOS setting behind that. > > This tendency of programs and syslog messages not to include a program source > identification is still with us, it seems. And, just saying that it's "Linux" > is not really enough info: Which distro? Release? Is it up to date? > > -- > Shane Castle > Data Security Mgr, Boulder County IT > CISSP GSEC GCIH > > > > > > > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of Jeremy Lee > Sent: Wednesday, February 16, 2011 15:48 > To: [email protected] > Subject: Re: [ossec-list] Re: alert level 2 error > > Hmm... I'm not sure what that's from then. > > If you want to ignore, you can simply add a rule to local_rules.xml. > Something like this: > > <rule id="400001" level="0"> > <match>error initializing: -1</match> > <description>Ignore "error initializing: -1" messages</description> > </rule> > > The risk is that this rule will ignore anything matching that "error > initializing: -1" keyword. > > I would still try to find out where that error is coming from though, just > for the sake of due diligence. > > On Wed, Feb 16, 2011 at 1:59 PM, OSSEC <[email protected]> wrote: > > ok, i saw messages in other servers like this > > Feb 16 07:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 08:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 09:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 10:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 11:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 12:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 13:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 14:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 15:52:42 bai2-ibm-db1 : error initializing: -1 > Feb 16 16:52:42 bai2-ibm-db1 : error initializing: -1 > > exactly every hour. So the DHCP looks irrelevant to the errors. > > It could be an IBM thing? but why just starting happening now? > > if i want to ignore it ... it will be a risk involved? if so how i can > ignore the alert > > On Feb 16, 4:28 pm, Jeremy Lee <[email protected]> wrote: > > Looks like it's an issue with DHCP. Did you try Google to look for > help on > > why DHCP might be acting up? Do you have multiple ethernet adapters > on this > > server? > > > If you're certain these errors aren't symptoms of a larger problem, > you > > could always setup a rule to ignore them. > > > On Wed, Feb 16, 2011 at 1:18 PM, OSSEC <[email protected]> > wrote: > > > Here is in another server > > > > Feb 16 15:31:43 BAI-MW1 dhclient: bound to 169.254.95.120 -- > renewal > > > in 301 seconds. > > > Feb 16 15:35:43 BAI-MW1 : error initializing: -1 > > > Feb 16 15:36:44 BAI-MW1 dhclient: DHCPREQUEST on usb0 to > > > 169.254.95.118 port 67 > > > Feb 16 15:36:44 BAI-MW1 dhclient: DHCPACK from 169.254.95.118 > > > > These servers are used for weblogic > > > > On the other two servers the date is wrong ... will fix that > soon, > > > but im not sure if that was causing the issue. (these are test > > > servers) > > > > On Feb 16, 3:58 pm, "dan (ddp)" <[email protected]> wrote: > > > > Look at the proceeding lines, maybe there is a clue there. > What's the > > > > purpose of this system? > > > > > On Wed, Feb 16, 2011 at 3:36 PM, OSSEC > <[email protected]> wrote: > > > > > Im using linux > > > > > > Here is what i found in /var/log/messages > > > > > > Feb 16 15:15:33 BAI-DB2 : error initializing: -1 > > > > > > tons of those lines > > > > > > On Feb 16, 3:20 pm, Jeremy Lee <[email protected]> wrote: > > > > >> If in Windows just open the log with Notepad, Wordpad, etc > and run a > > > "Find" > > > > > >> You should be able to identify the log source that this came > from, as > > > Dan > > > > >> has pointed out. > > > > > >> Let us know. > > > > > >> On Wed, Feb 16, 2011 at 12:12 PM, dan (ddp) > <[email protected]> wrote: > > > > >> > As can be seen here: > > > > >> >http://www.ossec.net/wiki/Know_How:Email_Alerts_below_7 > > > > >> > the name of the logfile is generally in the alert > ("Received From: > > > > >> > (foo) 192.168.0.2->/var/log/messages"). > > > > >> > If it isn't in your alert message, you can use grep if > you're on a > > > > >> > sane(r) system. I'm not sure how to find it with Windows. > > > > > >> > On Wed, Feb 16, 2011 at 3:06 PM, OSSEC > <[email protected]> > > > wrote: > > > > >> > > Hey Dan, > > > > > >> > > bai-mw1 is the name of the agent. How i can find out the > log that > > > > >> > > message is hidden? > > > > > >> > > thanks > > > > > >> > > On Feb 16, 2:50 pm, "dan (ddp)" <[email protected]> wrote: > > > > >> > >> Hi Chris, > > > > >> > >> Find out what BAI-MW1 is. Knowing which log that > message is > > > hidden in > > > > >> > >> might be useful. > > > > >> > >> Then write a rule for the log message. > > > > > >> > >> On Wed, Feb 16, 2011 at 2:46 PM, OSSEC > <[email protected] > > > > > >> > wrote: > > > > >> > >> > Greetings, > > > > > >> > >> > all of the sudden i've started receiving the > following error > > > message > > > > > >> > >> > "Unknown problem somewhere in the system." > > > > >> > >> > Portion of the log(s): > > > > > >> > >> > Feb 16 14:35:43 BAI-MW1 : error initializing: -1 > > > > > >> > >> > I;ve restarted the agents and servers but i still > having the > > > same > > > > >> > >> > issue. These alerts are coming out of few agents not > all of > > > them. > > > > > >> > >> > ANy ideas please? > > > > > >> > >> > thanks
