On Tue, May 8, 2012 at 1:58 PM, Sun Poon <[email protected]> wrote: > argh.....I put it in all servers and agents. Looks like I needa redo > the whole thing again. > Would it sounds better the use agent.conf to centralize all stuff? I > don't actually have access to those machines after the deployment/UAT. >
I'm a fan of agent.conf, but I can't make that decision for you. > On May 9, 1:52 am, "dan (ddp)" <[email protected]> wrote: >> On Tue, May 8, 2012 at 1:44 PM, Sun Poon <[email protected]> wrote: >> > Um. actually 9 agents out of 11 failed to report alerts on the file >> > integrity checksum issue. >> > Perhaps I should list out the deployment procedures here for your >> > reference: >> > 1) I deployed 11 agents, run for a few weeks >> > 2) I observed that file integrity alerts are in good mood, they >> > appears >> > 3) Suddenly, those alerts hate me and didn't show up >> > 4) I discovered that there is flag call <auto-ignore> that creates the >> > problem >> > 5) I updated the configuration files and disabled the <auto-ignore> >> > flag, restart the agents. >> >> Add this setting to the OSSEC server's ossec.conf and restart the >> server's ossec processes. I think this is a server side setting. >> >> >> >> >> >> >> >> > 6) I issue the command "syscheck-update -a" to rebuild the database. >> > 7) Alerts are still gone like wind. :( >> >> > On May 9, 1:27 am, "dan (ddp)" <[email protected]> wrote: >> >> On Tue, May 8, 2012 at 1:10 PM, Sun Poon <[email protected]> wrote: >> >> > That might be the reason to the problem. But how about the missed >> >> > alert cases? I wonder if problem would occur if I set the frequency to >> >> > high :/ But my boss insist on making this "real-time". >> >> >> I haven't had an issue with that. Is there any commonality? Is it the >> >> same files that aren't generating alerts? Are they in the database? >> >> Have they alerted at all? You set auto ignore to no on the manager, >> >> right? And restarted the OSSEC processes? >> >> >> > On May 9, 1:05 am, "dan (ddp)" <[email protected]> wrote: >> >> >> On Tue, May 8, 2012 at 12:57 PM, Sun Poon <[email protected]> >> >> >> wrote: >> >> >> > It's around 11 minutes according to the log. >> >> >> >> Perhaps the <frequency>900</frequency> begins counting after the >> >> >> completion of the previous scan? >> >> >> >> > On Wednesday, May 9, 2012 12:50:31 AM UTC+8, dan (ddpbsd) wrote: >> >> >> >> >> On Tue, May 8, 2012 at 12:24 PM, Sun Poon <[email protected]> >> >> >> >> wrote: >> >> >> >> > Dear Sir/Madam, >> >> >> >> >> > I deployed OSSEC as a HIDS agent to a big old system (SUSE 9 >> >> >> >> > without >> >> >> >> > inotify) in our company. Being required by my boss, it is >> >> >> >> > essential >> >> >> >> > for me to report critical file changes ASAP to various system >> >> >> >> > owners. >> >> >> >> >> > With the limitation, I decided to use frequent syscheck to >> >> >> >> > replace the >> >> >> >> > real-time features. I set the frequency to >> >> >> >> > <frequency>900</frequency>, >> >> >> >> > I have also disabled the auto-ignore feature. However, it is >> >> >> >> > discovered that the file change event appears 30 minutes later, or >> >> >> >> > even not showing up. I have checked that the database is not >> >> >> >> > empty by >> >> >> >> > using ossec-wui. Is there any configuration error I have made? >> >> >> >> >> > Best Regards, >> >> >> >> > Sun >> >> >> >> >> How long does a scan take? I can't imagine a scan of any decent size >> >> >> >> taking less than 900 seconds.
