On Fri, Aug 24, 2012 at 10:41 AM, Michael Barrett <[email protected]> wrote: > > > I turned logall on, doesn't seem to make a difference in the message >
The idea is to see if the "incorrectly formatted" log messages get logged to archives.log. > How do I turn debug on? > /var/ossec/bin/ossec-control enable debug && /var/ossec/bin/ossec-control restart > > > ____________________________________________ > Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty > Insurance Corporation > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > 1.888.601.4440 | * [email protected] > > This message is intended for use only by the person(s) addressed above and > may contain privileged and confidential information. Disclosure or use of > this message by any other person is strictly prohibited. If this message is > received in error, please notify the sender immediately and delete this > message. > > > > From: "dan (ddp)" <[email protected]> > To: [email protected] > Date: 08/21/2012 11:40 AM > Subject: Re: [ossec-list] 2.5.1 > Sent by: [email protected] > > ________________________________ > > > > On Tue, Aug 21, 2012 at 12:36 PM, Michael Barrett > <[email protected]> wrote: > > > > > > So if re-installing doesn't work, any ideas of what I can try? > > ____________________________________________ > > > Could there be a networking device messing things up in between? Is > this the only system having issues? Turn on logall on the server? Turn > on debug on the server? Try to add to the log message to get the > initial incorrectly formatted message? > > > Michael Barrett | Information Security Analyst - Lead | Mortgage > > Guaranty > > Insurance Corporation > > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > > 1.888.601.4440 | * [email protected] > > > > This message is intended for use only by the person(s) addressed above > > and > > may contain privileged and confidential information. Disclosure or use > > of > > this message by any other person is strictly prohibited. If this message > > is > > received in error, please notify the sender immediately and delete this > > message. > > > > > > > > From: "dan (ddp)" <[email protected]> > > To: [email protected] > > Date: 08/21/2012 11:15 AM > > Subject: Re: [ossec-list] 2.5.1 > > Sent by: [email protected] > > > > ________________________________ > > > > > > > > On Tue, Aug 21, 2012 at 11:18 AM, Michael Barrett > > <[email protected]> wrote: > > > > > > Is this the only agent on this network? Could there be a networking > > > device messing things up in between? Is this the only host having > > > issues? Is the server listening on multiple networks? What does v2.5.1 > > > have to do with this? > > > > > > > > > No this isn't the only host > > > > > > The server is only listening on one IP > > > > > > The agent has 2.5.1 and we are not ready to go to 2.6 and i wanted a > > > fresh > > > install > > > ________________________________ > > > > What are you going to do when 2.7 comes out? Wait till 2.8 is almost > > ready? > > > > ____________ > > > Michael Barrett | Information Security Analyst - Lead | Mortgage > > > Guaranty > > > Insurance Corporation > > > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > > > 1.888.601.4440 | * [email protected] > > > > > > This message is intended for use only by the person(s) addressed above > > > and > > > may contain privileged and confidential information. Disclosure or use > > > of > > > this message by any other person is strictly prohibited. If this > > > message > > > is > > > received in error, please notify the sender immediately and delete > > > this > > > message. > > > > > >
