Got it Thanks
One more quick question. Do I need to push this build out to all servers and clients or just the servers and will an upgrade install be sufficient? I appreciate the quick reply. ShermanB On 2/17/11 11:24 AM, "Daniel Cid" <[email protected]> wrote: >Hi, > >Can you try the latest code from here: >https://bitbucket.org/dcid/ossec-hids > >*Just click on "get source" to download it. > >thanks, > >On Thu, Feb 17, 2011 at 2:33 PM, Sherman Butler <[email protected]> >wrote: >> >> In Dec there was discussion about the ossec-keepalive causing a false >> alarm when it encounters an empty log file. At that time a beta build >>of >> the code was supposed to fix the problem. >> >> I've installed ossec-hids-101203.tar on all my servers and clients using >> upgrade but not a completely fresh installation. >> >> I'm continuing to see the same alerts. Has any more work been done to >> eliminate these false alarms. >> >> OSSEC HIDS Notification OLY VZW. >> 2011 Feb 17 05:27:11 >> >> Received From: (tps1-mgmt.stg01.oly.cequintecid.com) >> 10.10.2.51->ossec-keepalive >> Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." >> Portion of the log(s): >> >> --MARK--: >> >>67=&KQ;Yy1R4O'TsdiyX?iG0B=nlI4K-g5yuAN1K-Bti_]]SBSnzAoILRmjQ99_wF+_wim=%L >>x. >> >>_L2(8hzM/C_)d$.p+(;$5ueyEqa'AhDPWVJ/&?Ah%-qZEutsGyXQt/KBd8#'%^I(SdnxY@d3C >>s5 >> >>EYRvVVJpCKxP!Rd@GGk-feRrORyf?ysahB)O/o@U^;XoH*In2Q-FI,$[YiSJhvzC)Kf6^T5?o >>-! >> >>Ru_J=ob5;;ySmX3vM@LxkMdQdv,l9oSK.ssO;P.$!;N+iSf2$g-';l@b[PMN9x+VBGPuXF(&N >>2? >> >>UfWE8inPf(=poh[$4gyO96%/t9Bi[dTp*,bc$;p]1po$.7b3Aq6tqL3!njsdnXccP*=174n!0 >>3d >> >>V].g2M#Pq6vu3^y#)69TQ[[5NnnVF/l)6J!*&%%T#Ln$Y?Z;CUq5rij80t6P%]/g),+5R04T_ >>KH >> >>6=VqNsuwh0RsFaD0YhJ*l4,%NLZb2Ei%IkQwPa;zNqG8xId!h[=BZ2tk7Nx-)=xlwJ4tfedqT >>=n >> t;y%v0]Q_[.p5ybDUr=3*.6IluX=_a6iS/enS#Y4f_*%9dOVUaYBBe^QhA >> >> >> >> --END OF NOTIFICATION >> >> >> >> I have tried local rules to ignore the alerts but haven't hit upon the >> magic combo that works. I really don't care to be alerted about what >>is >> clearly something that's not a problem to me. >> >> <rule id="100003" level="0"> >> <if_sid>1002</if_sid> >> <match>ossec-keepalive</match> >> <description>Ignore any errors reported by nagios</description> >> </rule> >> >> >> Any assistance will be much appreciated. >> >> Sherman Butler | Server Operations >> >> Cequint Incorporated >> 1011 Western Avenue | Suite 800 >> Seattle | WA | 98104 >> >> p: 206.576.7255 >> m: 425.359.3886 >> f: 206.299.9127 >> >>
