Hi, Can you try the latest code from here: https://bitbucket.org/dcid/ossec-hids
*Just click on "get source" to download it. thanks, On Thu, Feb 17, 2011 at 2:33 PM, Sherman Butler <[email protected]> wrote: > > In Dec there was discussion about the ossec-keepalive causing a false > alarm when it encounters an empty log file. At that time a beta build of > the code was supposed to fix the problem. > > I've installed ossec-hids-101203.tar on all my servers and clients using > upgrade but not a completely fresh installation. > > I'm continuing to see the same alerts. Has any more work been done to > eliminate these false alarms. > > OSSEC HIDS Notification OLY VZW. > 2011 Feb 17 05:27:11 > > Received From: (tps1-mgmt.stg01.oly.cequintecid.com) > 10.10.2.51->ossec-keepalive > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > --MARK--: > 67=&KQ;Yy1R4O'TsdiyX?iG0B=nlI4K-g5yuAN1K-Bti_]]SBSnzAoILRmjQ99_wF+_wim=%Lx. > _L2(8hzM/C_)d$.p+(;$5ueyEqa'AhDPWVJ/&?Ah%-qZEutsGyXQt/KBd8#'%^I(SdnxY@d3Cs5 > EYRvVVJpCKxP!Rd@GGk-feRrORyf?ysahB)O/o@U^;XoH*In2Q-FI,$[YiSJhvzC)Kf6^T5?o-! > Ru_J=ob5;;ySmX3vM@LxkMdQdv,l9oSK.ssO;P.$!;N+iSf2$g-';l@b[PMN9x+VBGPuXF(&N2? > UfWE8inPf(=poh[$4gyO96%/t9Bi[dTp*,bc$;p]1po$.7b3Aq6tqL3!njsdnXccP*=174n!03d > V].g2M#Pq6vu3^y#)69TQ[[5NnnVF/l)6J!*&%%T#Ln$Y?Z;CUq5rij80t6P%]/g),+5R04T_KH > 6=VqNsuwh0RsFaD0YhJ*l4,%NLZb2Ei%IkQwPa;zNqG8xId!h[=BZ2tk7Nx-)=xlwJ4tfedqT=n > t;y%v0]Q_[.p5ybDUr=3*.6IluX=_a6iS/enS#Y4f_*%9dOVUaYBBe^QhA > > > > --END OF NOTIFICATION > > > > I have tried local rules to ignore the alerts but haven't hit upon the > magic combo that works. I really don't care to be alerted about what is > clearly something that's not a problem to me. > > <rule id="100003" level="0"> > <if_sid>1002</if_sid> > <match>ossec-keepalive</match> > <description>Ignore any errors reported by nagios</description> > </rule> > > > Any assistance will be much appreciated. > > Sherman Butler | Server Operations > > Cequint Incorporated > 1011 Western Avenue | Suite 800 > Seattle | WA | 98104 > > p: 206.576.7255 > m: 425.359.3886 > f: 206.299.9127 > >
