In Dec there was discussion about the ossec-keepalive causing a false
alarm when it encounters an empty log file. At that time a beta build of
the code was supposed to fix the problem.
I've installed ossec-hids-101203.tar on all my servers and clients using
upgrade but not a completely fresh installation.
I'm continuing to see the same alerts. Has any more work been done to
eliminate these false alarms.
OSSEC HIDS Notification OLY VZW.
2011 Feb 17 05:27:11
Received From: (tps1-mgmt.stg01.oly.cequintecid.com)
10.10.2.51->ossec-keepalive
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
--MARK--:
67=&KQ;Yy1R4O'TsdiyX?iG0B=nlI4K-g5yuAN1K-Bti_]]SBSnzAoILRmjQ99_wF+_wim=%Lx.
_L2(8hzM/C_)d$.p+(;$5ueyEqa'AhDPWVJ/&?Ah%-qZEutsGyXQt/KBd8#'%^I(SdnxY@d3Cs5
EYRvVVJpCKxP!Rd@GGk-feRrORyf?ysahB)O/o@U^;XoH*In2Q-FI,$[YiSJhvzC)Kf6^T5?o-!
Ru_J=ob5;;ySmX3vM@LxkMdQdv,l9oSK.ssO;P.$!;N+iSf2$g-';l@b[PMN9x+VBGPuXF(&N2?
UfWE8inPf(=poh[$4gyO96%/t9Bi[dTp*,bc$;p]1po$.7b3Aq6tqL3!njsdnXccP*=174n!03d
V].g2M#Pq6vu3^y#)69TQ[[5NnnVF/l)6J!*&%%T#Ln$Y?Z;CUq5rij80t6P%]/g),+5R04T_KH
6=VqNsuwh0RsFaD0YhJ*l4,%NLZb2Ei%IkQwPa;zNqG8xId!h[=BZ2tk7Nx-)=xlwJ4tfedqT=n
t;y%v0]Q_[.p5ybDUr=3*.6IluX=_a6iS/enS#Y4f_*%9dOVUaYBBe^QhA
--END OF NOTIFICATION
I have tried local rules to ignore the alerts but haven't hit upon the
magic combo that works. I really don't care to be alerted about what is
clearly something that's not a problem to me.
<rule id="100003" level="0">
<if_sid>1002</if_sid>
<match>ossec-keepalive</match>
<description>Ignore any errors reported by nagios</description>
</rule>
Any assistance will be much appreciated.
Sherman Butler | Server Operations
Cequint Incorporated
1011 Western Avenue | Suite 800
Seattle | WA | 98104
p: 206.576.7255
m: 425.359.3886
f: 206.299.9127
