On Wed, May 9, 2012 at 9:03 AM, secatoor <[email protected]> wrote: > Hi dan, > > With ps aux | grep dbd I get this: > > ossecm 2006 0.0 0.4 5372 2124 ? S 11:35 0:00 > /var/ossec/bin/ossec-dbd > > So yes, dbd seems to be still running and there is no error in ossec.log > file. > Both /var/log/mysql.log and /var/log/mysql.err are empty, seems to be no > more information (may be I should change mysql logging level). >
Perhaps running ossec-dbd in debug mode might help. I don't use ossec-dbd so I'm not really much help. > Texte editor is ready to get creative :) > > Thanks > > > > On Wednesday, May 9, 2012 1:16:47 PM UTC+2, secatoor wrote: >> >> Hi all, >> >> Like well explained in the OSSEC documentation, I "upgraded" my OSSEC >> server to log into mysql database. I compiled OSSEC with setdb and >> updated the previous installation. >> I got mysql and OSSEC server working on the same machine. >> >> I made the ossec database with the mysql.schema file and created the >> "ossec" user account to allow connecting to mysql. >> >> OSSEC starts up fine, and in the /var/ossec/logs/ossec.log file I can >> see this line wich means to it should be able to connect correctly to >> database: >> >> 2012/05/09 11:35:32 ossec-dbd: Connected to database 'ossec' at >> '127.0.0.1'. >> >> >> But... it seems working fine during a few minutes and then... >> nothing ! >> >> When I connec to mysql to show the content of the "data" table (select >> * from data) I get this: >> >> +----+-----------+-------- >> >> +----------------------------------------------------------------------------------------------------------------------------------------------------------------------- >> + >> | id | server_id | user | >> full_log >> | >> +----+-----------+-------- >> >> +----------------------------------------------------------------------------------------------------------------------------------------------------------------------- >> + >> | 1 | 1 | (null) | ossec: Ossec >> started. >> | >> | 2 | 1 | root | May 7 16:57:29 vm3 sshd[2329]: >> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 >> tty=ssh ruser= rhost=g-test.local user=root | >> | 3 | 1 | root | May 7 16:57:30 vm3 sshd[2329]: Failed >> password for root from 192.168.1.20 port 48068 >> ssh2 >> | >> | 4 | 1 | root | May 7 16:57:43 vm3 sshd[2329]: Failed >> password for root from 192.168.1.20 port 48068 >> ssh2 >> | >> | 5 | 1 | root | May 7 16:57:44 vm3 sshd[2329]: Accepted >> password for root from 192.168.1.20 port 48068 >> ssh2 >> | >> | 6 | 1 | (null) | May 7 16:57:44 vm3 sshd[2329]: >> pam_unix(sshd:session): session opened for user root by >> (uid=0) >> | >> | 7 | 1 | (null) | May 7 16:57:48 vm3 sshd[2329]: >> pam_unix(sshd:session): session closed for user >> root >> | >> | 8 | 1 | (null) | May 7 17:25:32 vm3 sshd[2878]: >> pam_unix(sshd:session): session opened for user root by >> (uid=0) >> | >> | 9 | 1 | (null) | May 7 17:25:36 vm3 sshd[2878]: >> pam_unix(sshd:session): session closed for user >> root >> | >> | 10 | 1 | (null) | May 9 09:53:49 vm3 gnome-screensaver- >> dialog: pam_unix(gnome-screensaver:auth): authentication failure; >> logname= uid=1000 euid=1000 tty=:0.0 ruser= rhost= user=user | >> | 11 | 1 | (null) | May 9 09:56:27 vm3 sshd[1993]: Invalid >> user test from >> 192.168.1.20 >> | >> | 12 | 1 | (null) | May 9 09:56:27 vm3 sshd[1993]: Failed >> none for invalid user test from 192.168.1.20 port 39825 >> ssh2 | >> +----+-----------+-------- >> >> +----------------------------------------------------------------------------------------------------------------------------------------------------------------------- >> + >> 12 rows in set (0.00 sec) >> >> >> Which shows that I succeeded to connect via ssh with my "root" account >> and that I tried with a false account. >> >> But the next hour I tried to log again with a false account (to check >> if OSSEC is working fine) and nothing had been logged into mysql... >> >> And when I open the /var/ossec/logs/archives/2012/May/ossec- >> archive-09.log file, I can observe things like : >> >> 2012 May 09 11:36:10 vm3->/var/log/auth.log May 9 11:36:10 vm3 >> sshd[2038]: Invalid user foker from 192.168.1.20 >> 2012 May 09 11:36:10 vm3->/var/log/auth.log May 9 11:36:10 vm3 >> sshd[2038]: Failed none for invalid user foker from 192.168.1.20 port >> 39834 ssh2 >> 2012 May 09 11:36:14 vm3->/var/log/auth.log May 9 11:36:13 vm3 >> sshd[2038]: pam_unix(sshd:auth): check pass; user unknown >> 2012 May 09 11:36:14 vm3->/var/log/auth.log May 9 11:36:13 vm3 >> sshd[2038]: pam_unix(sshd:auth): authentication failure; logname= >> uid=0 euid=0 tty=ssh ruser= rhost=g-test.local >> 2012 May 09 11:36:16 vm3->/var/log/auth.log May 9 11:36:15 vm3 >> sshd[2038]: Failed password for invalid user foker from 192.168.1.20 >> port 39834 ssh2 >> 2012 May 09 11:36:18 vm3->/var/log/auth.log May 9 11:36:16 vm3 >> sshd[2038]: pam_unix(sshd:auth): check pass; user unknown >> 2012 May 09 11:36:20 vm3->/var/log/auth.log May 9 11:36:18 vm3 >> sshd[2038]: Failed password for invalid user foker from 192.168.1.20 >> port 39834 ssh2 >> 2012 May 09 11:36:20 vm3->/var/log/auth.log May 9 11:36:19 vm3 >> sshd[2038]: pam_unix(sshd:auth): check pass; user unknown >> 2012 May 09 11:36:22 vm3->/var/log/auth.log May 9 11:36:21 vm3 >> sshd[2038]: Failed password for invalid user foker from 192.168.1.20 >> port 39834 ssh2 >> 2012 May 09 11:36:22 vm3->/var/log/auth.log May 9 11:36:21 vm3 >> sshd[2038]: PAM 2 more authentication failures; logname= uid=0 euid=0 >> tty=ssh ruser= rhost=g-test.local >> >> That makes understand that OSSEC is logging but not in the database... >> I checked the /var/ossec/logs/ossec.log file again and there was no >> problem with dbd. >> >> Is there something specific I have to tell OSSEC to make it stop >> logging into log files and log into mysql database ? >> >> I tried starting it again and again but it still does not work fine (I >> even tried from scratch, with no previous installation)... >> >> If someone has any idea, you're welcome ;) >> Thanks
