Are you sure you can search for multiple groups in the same report? The
only one you haven't tried to do that is the one that works right?
On Apr 5, 2012 4:12 AM, "carlopmart" <[email protected]> wrote:
> Hi all,
>
> I have some problems to generate daily reports. I have defined three
> reports like this:
>
> <reports>
> <group>rbn|dshield</group>
> <title>OSSEC Daily Report: Access from Blacklists</title>
> <email_to>root@localhost</**email_to>
> </reports>
>
> <reports>
> <group>cpfirewall|**cpmgmtfirewall</group>
> <title>OSSEC Daily Report: CheckPoint Firewall-1 Statistics</title>
> <email_to>root@localhost</**email_to>
> </reports>
>
> <reports>
> <group>jpfirewall</group>
> <title>OSSEC Daily Report: JunOS Firewall Statistics</title>
> <email_to>root@localhost</**email_to>
> </reports>
>
> In ossec.log file I see these warnings:
>
> 2012/04/05 00:00:33 ossec-monitord: INFO: Starting daily reporting for
> 'OSSEC Daily Report: Access from Blacklists'
> 2012/04/05 00:00:53 ossec-monitord: INFO: Starting daily reporting for
> 'OSSEC Daily Report: CheckPoint Firewall-1 Statistics'
> 2012/04/05 00:01:11 ossec-monitord: INFO: Report 'OSSEC Daily Report:
> Access from Blacklists' completed and zero alerts post-filter.
> 2012/04/05 00:01:11 ossec-monitord: INFO: Report 'OSSEC Daily Report:
> Access from Blacklists' empty.
> 2012/04/05 00:01:13 ossec-monitord: INFO: Starting daily reporting for
> 'OSSEC Daily Report: JunOS Firewall Statistics'
> 2012/04/05 00:01:28 ossec-monitord: INFO: Report 'OSSEC Daily Report:
> CheckPoint Firewall-1 Statistics' completed and zero alerts post-filter.
> 2012/04/05 00:01:28 ossec-monitord: INFO: Report 'OSSEC Daily Report:
> CheckPoint Firewall-1 Statistics' empty.
> 2012/04/05 00:01:48 ossec-monitord: WARN: Report taking too long to
> complete. Waiting for it to finish...
> 2012/04/05 00:02:03 ossec-monitord: WARN: Report taking too long to
> complete. Waiting for it to finish...
> 2012/04/05 00:02:18 ossec-monitord: WARN: Report taking too long to
> complete. Waiting for it to finish...
> 2012/04/05 00:02:28 ossec-monitord: INFO: Report 'OSSEC Daily Report:
> JunOS Firewall Statistics' completed. Creating output...
> 2012/04/05 00:02:33 ossec-monitord: WARN: Report taking too long to
> complete. Waiting for it to finish...
>
> last report is generated, but not the other two ... Maybe I have
> missconfigured something??
>
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
>
