Hi all,
I have some problems to generate daily reports. I have defined three
reports like this:
<reports>
<group>rbn|dshield</group>
<title>OSSEC Daily Report: Access from Blacklists</title>
<email_to>root@localhost</email_to>
</reports>
<reports>
<group>cpfirewall|cpmgmtfirewall</group>
<title>OSSEC Daily Report: CheckPoint Firewall-1 Statistics</title>
<email_to>root@localhost</email_to>
</reports>
<reports>
<group>jpfirewall</group>
<title>OSSEC Daily Report: JunOS Firewall Statistics</title>
<email_to>root@localhost</email_to>
</reports>
In ossec.log file I see these warnings:
2012/04/05 00:00:33 ossec-monitord: INFO: Starting daily reporting for
'OSSEC Daily Report: Access from Blacklists'
2012/04/05 00:00:53 ossec-monitord: INFO: Starting daily reporting for
'OSSEC Daily Report: CheckPoint Firewall-1 Statistics'
2012/04/05 00:01:11 ossec-monitord: INFO: Report 'OSSEC Daily Report:
Access from Blacklists' completed and zero alerts post-filter.
2012/04/05 00:01:11 ossec-monitord: INFO: Report 'OSSEC Daily Report:
Access from Blacklists' empty.
2012/04/05 00:01:13 ossec-monitord: INFO: Starting daily reporting for
'OSSEC Daily Report: JunOS Firewall Statistics'
2012/04/05 00:01:28 ossec-monitord: INFO: Report 'OSSEC Daily Report:
CheckPoint Firewall-1 Statistics' completed and zero alerts post-filter.
2012/04/05 00:01:28 ossec-monitord: INFO: Report 'OSSEC Daily Report:
CheckPoint Firewall-1 Statistics' empty.
2012/04/05 00:01:48 ossec-monitord: WARN: Report taking too long to
complete. Waiting for it to finish...
2012/04/05 00:02:03 ossec-monitord: WARN: Report taking too long to
complete. Waiting for it to finish...
2012/04/05 00:02:18 ossec-monitord: WARN: Report taking too long to
complete. Waiting for it to finish...
2012/04/05 00:02:28 ossec-monitord: INFO: Report 'OSSEC Daily Report:
JunOS Firewall Statistics' completed. Creating output...
2012/04/05 00:02:33 ossec-monitord: WARN: Report taking too long to
complete. Waiting for it to finish...
last report is generated, but not the other two ... Maybe I have
missconfigured something??
--
CL Martinez
carlopmart {at} gmail {d0t} com
