You are right. IPv6 is the issue: Apparently, IPv6 is supported in OSSEC 2.6, but I guess because we're not using using IPv6, OSSEC fails to parse the proftpd logs. OSSEC can parse this line if I remove the ::ffff:
Jul 18 10:18:09 ::ffff:24.249.207.4 proftpd[100] INFO: Login incorrect. PASS (hidden) It seems I have two options: 1. turn off IPv6 2. modify a decoder file to account for the "::ffff:", but which one? Gil Vidals On Wed, Jul 18, 2012 at 8:15 AM, Peter M Abraham < [email protected]> wrote: > Gil, nice to see you here. > > On the agent servers, I use the following in /var/ossec/etc/ossec.conf and > it works: > > <localfile> > <log_format>syslog</log_format> > <location>/var/log/proftpd/current</location> > </localfile> > > What you may want to do, if you are not yet up to IPv6 is turn off IPv6 > and that will get rid of the "::ffff:" entries which are probably the > culprit. > > Thank you. > > -- Gil Vidals CONFIDENTIALITY NOTICE: The information contained in this transmission may contain privileged and confidential information. It is intended only for the use of the person(s) named above. If you are not the intended recipient, please contact the sender by reply email and permanently delete the original message.
