Hi,
I don't find any option to make mysl more talkative (there is no log level option). I thought it could be linked with the number of simultaneous sessions, but I still can connect to with the ossec user myself ! By the way dbd in debug mode don't gives me anything more than this: 2012/05/14 09:24:57 ossec-dbd: DEBUG: Starting ... 2012/05/14 09:24:57 adding rule: rules_config.xml 2012/05/14 09:24:57 adding rule: pam_rules.xml 2012/05/14 09:24:57 adding rule: sshd_rules.xml 2012/05/14 09:24:57 adding rule: telnetd_rules.xml 2012/05/14 09:24:57 adding rule: syslog_rules.xml 2012/05/14 09:24:57 adding rule: arpwatch_rules.xml 2012/05/14 09:24:57 adding rule: symantec-av_rules.xml 2012/05/14 09:24:57 adding rule: symantec-ws_rules.xml 2012/05/14 09:24:57 adding rule: pix_rules.xml 2012/05/14 09:24:57 adding rule: named_rules.xml 2012/05/14 09:24:57 adding rule: smbd_rules.xml 2012/05/14 09:24:57 adding rule: vsftpd_rules.xml 2012/05/14 09:24:57 adding rule: pure-ftpd_rules.xml 2012/05/14 09:24:57 adding rule: proftpd_rules.xml 2012/05/14 09:24:57 adding rule: ms_ftpd_rules.xml 2012/05/14 09:24:57 adding rule: ftpd_rules.xml 2012/05/14 09:24:57 adding rule: hordeimp_rules.xml AND ALL THE OTHER RULES... AND THEN : 2012/05/14 09:24:57 ossec-dbd: DEBUG: Connecting to '127.0.0.1', using 'XXXX', 'XXXXX', 'ossec', 0,'(null)'. 2012/05/14 09:24:57 ossec-dbd: Connected to database 'ossec' at '127.0.0.1'. 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering OS_Server_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: Reading rules file: 'rules_config.xml' 2012/05/14 09:24:57 ossec-dbd: DEBUG: read xml for rule '/rules/rules_config.xml'. 2012/05/14 09:24:57 ossec-dbd: DEBUG: XML Variables applied. 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: Reading rules file: 'pam_rules.xml' 2012/05/14 09:24:57 ossec-dbd: DEBUG: read xml for rule '/rules/pam_rules.xml'. 2012/05/14 09:24:57 ossec-dbd: DEBUG: XML Variables applied. 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB() 2012/05/14 09:24:57 ossec-dbd: DEBUG: entering _Groups_ReadInsertDB AND SO ON ! As you can see OSSEC succesfully connects to mysql. I think there must be something with mysql, but because I don't get it's log verbose higher it's not going to be easy. Any idea ? On Friday, May 11, 2012 2:09:18 PM UTC+2, dan (ddpbsd) wrote: > > On Fri, May 11, 2012 at 3:19 AM, secatoor wrote: > > Thanks scott ;) > > > > Yep, I tried using dbd with -d for debug mode but I do not understand > where > > the debbuging logs go to... I'm actually looking to make mysql more > > talkative about the insertions and updates, I'll keep you informed when > > succeeded. > > > > Debug logs go to /var/ossec/logs/ossec.log along with the regular logs. > > > On Thursday, May 10, 2012 8:09:26 PM UTC+2, dan (ddpbsd) wrote: > >> > >> On Thu, May 10, 2012 at 11:32 AM, secatoor wrote: > >> > Well, stoping OSSEC loggingg to log files is not really the problem, > I > >> > can > >> > handle that with a script... > >> > > >> > What I really would like to have is all the logs into mysql because > the > >> > volume of generated logs is too important to be crawled with a single > >> > script > >> > :( > >> > > >> > > >> > I really can not understand why mysql shows me all the INSERT and > UPDATE > >> > commands but does not execute them (not anymore, it worked only for > 12 > >> > lines)... > >> > > >> > >> Did you ever try running ossec-dbd in debug mode? > >> Do the mysql logs show the insert or whether it was successful or not? > >> If not, you might want to increase the verbosity or something. > >> > >> > > >> > Le jeudi 10 mai 2012 14:44:03 UTC+2, dan (ddpbsd) a écrit : > >> >> > >> >> On Thu, May 10, 2012 at 8:35 AM, Scott VR wrote: > >> >> > Well, like dan I don't actually use it, but like you, I have > >> >> > configured > >> >> > it. > >> >> > > >> >> > What dan said about writing code is of interest here, I think.. > And > >> >> > might be > >> >> > the key to what you want. Perhaps Dan will elaborate on what he > >> >> > meant. > >> >> > Maybe > >> >> > the database feature is incomplete, hence his suggestion that you > >> >> > fire > >> >> > up a > >> >> > text editor? > >> >> > > >> >> > Scott > >> >> > > >> >> > >> >> It works for most people, and I think it's used heavily by some > >> >> users.While I don't think the db stuff is feature complete, that's > not > >> >> what I meant. > >> >> > >> >> There is currently no way to not log to text files, and to change > that > >> >> you'd have to modify the source code. This isn't something I'd > >> >> consider a feature though. > >> >> > >> >> > >> >> > > >> >> > On May 10, 2012, at 4:36 AM, secatoor wrote: > >> >> > > >> >> > Hi Scott, > >> >> > > >> >> > Yes I did configure the "database output", otherwise we wouldn't > see > >> >> > the > >> >> > actions in mysql.log, these are the parameters I used: > >> >> > > >> >> > <database_output> > >> >> > <hostname>localhost</hostname> > >> >> > <username>ossecuser</username> > >> >> > <password>password</password> > >> >> > <database>ossec</database> > >> >> > <type>mysql</type> > >> >> > </database_output> > >> >> > > >> >> > There must be something wrong with mysql, is ther something > (timeout > >> >> > or > >> >> > maxConnection) that I should change ? > >> >> > > >> >> > Le mercredi 9 mai 2012 18:35:32 UTC+2, Scott VR a écrit : > >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> On May 9, 2012, at 6:16 AM, secatoor wrote: > >> >> >> > >> >> >> > Is there something specific I have to tell OSSEC to make it > stop > >> >> >> > logging into log files and log into mysql database ? > >> >> >> > > >> >> >> > >> >> >> Did you set database_output and appropriate credential, etc > >> >> >> parameters > >> >> >> in > >> >> >> ossec.conf? > >> >> >> > >> >> >> See http://www.ossec.net/doc/manual/output/database-output.html > >> >> >> > >> >> >> It sounds like you completed "Enabling database support", but > missed > >> >> >> "Enabling database output in configuration" perhaps. > >> >> >> > >> >> >> ScottVR > >> >> >> > >> >> >> > I tried starting it again and again but it still does not work > >> >> >> > fine > >> >> >> > (I > >> >> >> > even tried from scratch, with no previous installation)... > >> >> >> > > >> >> >> > If someone has any idea, you're welcome ;) > >> >> >> > Thanks >
