An upgrade will be fine. I'd try installing it on just the server first to see if the message still appears. But I'm not sure that it won't be required on the agents as well.
On Thu, Feb 17, 2011 at 2:30 PM, Sherman Butler <[email protected]> wrote: > Got it > > Thanks > > One more quick question. Do I need to push this build out to all servers > and clients or just the servers and will an upgrade install be sufficient? > > I appreciate the quick reply. > > ShermanB > > On 2/17/11 11:24 AM, "Daniel Cid" <[email protected]> wrote: > >>Hi, >> >>Can you try the latest code from here: >>https://bitbucket.org/dcid/ossec-hids >> >>*Just click on "get source" to download it. >> >>thanks, >> >>On Thu, Feb 17, 2011 at 2:33 PM, Sherman Butler <[email protected]> >>wrote: >>> >>> In Dec there was discussion about the ossec-keepalive causing a false >>> alarm when it encounters an empty log file. At that time a beta build >>>of >>> the code was supposed to fix the problem. >>> >>> I've installed ossec-hids-101203.tar on all my servers and clients using >>> upgrade but not a completely fresh installation. >>> >>> I'm continuing to see the same alerts. Has any more work been done to >>> eliminate these false alarms. >>> >>> OSSEC HIDS Notification OLY VZW. >>> 2011 Feb 17 05:27:11 >>> >>> Received From: (tps1-mgmt.stg01.oly.cequintecid.com) >>> 10.10.2.51->ossec-keepalive >>> Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." >>> Portion of the log(s): >>> >>> --MARK--: >>> >>>67=&KQ;Yy1R4O'TsdiyX?iG0B=nlI4K-g5yuAN1K-Bti_]]SBSnzAoILRmjQ99_wF+_wim=%L >>>x. >>> >>>_L2(8hzM/C_)d$.p+(;$5ueyEqa'AhDPWVJ/&?Ah%-qZEutsGyXQt/KBd8#'%^I(SdnxY@d3C >>>s5 >>> >>>EYRvVVJpCKxP!Rd@GGk-feRrORyf?ysahB)O/o@U^;XoH*In2Q-FI,$[YiSJhvzC)Kf6^T5?o >>>-! >>> >>>Ru_J=ob5;;ySmX3vM@LxkMdQdv,l9oSK.ssO;P.$!;N+iSf2$g-';l@b[PMN9x+VBGPuXF(&N >>>2? >>> >>>UfWE8inPf(=poh[$4gyO96%/t9Bi[dTp*,bc$;p]1po$.7b3Aq6tqL3!njsdnXccP*=174n!0 >>>3d >>> >>>V].g2M#Pq6vu3^y#)69TQ[[5NnnVF/l)6J!*&%%T#Ln$Y?Z;CUq5rij80t6P%]/g),+5R04T_ >>>KH >>> >>>6=VqNsuwh0RsFaD0YhJ*l4,%NLZb2Ei%IkQwPa;zNqG8xId!h[=BZ2tk7Nx-)=xlwJ4tfedqT >>>=n >>> t;y%v0]Q_[.p5ybDUr=3*.6IluX=_a6iS/enS#Y4f_*%9dOVUaYBBe^QhA >>> >>> >>> >>> --END OF NOTIFICATION >>> >>> >>> >>> I have tried local rules to ignore the alerts but haven't hit upon the >>> magic combo that works. I really don't care to be alerted about what >>>is >>> clearly something that's not a problem to me. >>> >>> <rule id="100003" level="0"> >>> <if_sid>1002</if_sid> >>> <match>ossec-keepalive</match> >>> <description>Ignore any errors reported by nagios</description> >>> </rule> >>> >>> >>> Any assistance will be much appreciated. >>> >>> Sherman Butler | Server Operations >>> >>> Cequint Incorporated >>> 1011 Western Avenue | Suite 800 >>> Seattle | WA | 98104 >>> >>> p: 206.576.7255 >>> m: 425.359.3886 >>> f: 206.299.9127 >>> >>> > >
