On Oct 31, 2013 3:10 AM, "De Nguyen" <[email protected]> wrote: > > Dear Dan, > > On my ossec server, i'm using rsyslogd for central syslog server. Config file is: > > /etc/sysconfig/rsyslog > > # Options to syslogd > # -m 0 disables 'MARK' messages. > # -rPortNumber Enables logging from remote machines. The listener will listen to the specified port. > # -x disables DNS lookups on messages recieved with -r > # See syslogd(8) for more details > SYSLOGD_OPTIONS="-c3" > # Options to klogd > # -2 prints all kernel oops messages twice; once for klogd to decode, and > # once for processing with 'ksymoops' > # -x disables all klogd processing of oops messages entirely > # See klogd(8) for more details > KLOGD_OPTIONS="-x" > > and /etc/rsyslog.conf : > > # Use traditional timestamp format > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > > # Provides kernel logging support (previously done by rklogd) > $ModLoad imklog > # Provides support for local system logging (e.g. via logger command) > $ModLoad imuxsock > > > # Log all kernel messages to the console. > # Logging much else clutters up the screen. > #kern.* /dev/console > > # Log anything (except mail) of level info or higher. > # Don't log private authentication messages! > *.info;mail.none;authpriv.none;cron.none /var/log/messages > > # The authpriv file has restricted access. > authpriv.* /var/log/secure > > # Log all the mail messages in one place. > mail.* -/var/log/maillog > > > # Log cron stuff > cron.* /var/log/cron > > # Everybody gets emergency messages > *.emerg * > > # Save news errors of level crit and higher in a special file. > uucp,news.crit /var/log/spooler > > # Save boot messages also to boot.log > local7.* /var/log/boot.log > $ModLoad imtcp > $InputTCPServerRun 514 > :FROMHOST-IP, isequal, "192.168.1.111" /var/log/rhel6.log > > > my ossec.conf : > > > > <ossec_config> > <global> > <email_notification>yes</email_notification> > <email_to>ossec@localhost</email_to> > <smtp_server>localhost.localdomain</smtp_server> > <email_from>ossecm@localhost</email_from> > <logall>yes</logall> > </global> > > <database_output> > <hostname>localhost</hostname> > <username>ossec</username> > <password>ossec</password> > <database>ossec</database> > <type>mysql</type> > </database_output> > > ... > > <global> > <white_list>127.0.0.1</white_list> > <white_list>^localhost.localdomain$</white_list> > <white_list>192.168.1.111</white_list> ### <-- My OSSEC server > <white_list>192.168.1.112</white_list> ### <-- My Agent linux Server > </global> > > ... > </ossec_config> > > > Anything else configuration is using ossec default. >
To use the client syslog functionality, you'll have to configure it. This page has the syntax details you need: http://ossec.net/doc/syntax/head_ossec_config.syslog_output.html > my ossec.log : > > > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading local decoder file. > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'rules_config.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'pam_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'sshd_rules.xml' > 2013/10/31 14:04:59 ossec-remoted: INFO: Started (pid: 12844). > 2013/10/31 14:04:59 ossec-remoted: Remote syslog allowed from: ' 221.133.0.0/28' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'telnetd_rules.xml' > 2013/10/31 14:04:59 ossec-remoted: INFO: Started (pid: 12845). > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'syslog_rules.xml' > 2013/10/31 14:04:59 ossec-remoted: INFO: Started (pid: 12846). > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'arpwatch_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'symantec-av_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'symantec-ws_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'pix_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'named_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'smbd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'vsftpd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'pure-ftpd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'proftpd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'ms_ftpd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'ftpd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'hordeimp_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'roundcube_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'wordpress_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'cimserver_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'vpopmail_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'vmpop3d_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'courier_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'web_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'web_appsec_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'apache_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'nginx_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'php_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'mysql_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'postgresql_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'ids_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'squid_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'firewall_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'cisco-ios_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'netscreenfw_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'sonicwall_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'postfix_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'sendmail_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'imapd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'mailscanner_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'dovecot_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'ms-exchange_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'racoon_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'vpn_concentrator_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'spamd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'msauth_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'mcafee_av_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'trend-osce_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'ms-se_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'zeus_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'solaris_bsm_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'vmware_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'ms_dhcp_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'asterisk_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'ossec_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'attack_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'openbsd_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'clam_av_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'bro-ids_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'dropbear_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Reading rules file: 'local_rules.xml' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Total rules enabled: '1289' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/mtab' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/mnttab' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/hosts.deny' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/mail/statistics' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/random-seed' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/adjtime' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/httpd/logs' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/utmpx' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/wtmpx' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/cups/certs' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/dumpdates' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: '/etc/svc/volatile' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/System32/LogFiles' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/Debug' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/WindowsUpdate.log' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/iis6.log' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/system32/wbem/Logs' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/system32/wbem/Repository' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/Prefetch' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/PCHEALTH/HELPCTR/DataColl' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/SoftwareDistribution' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/Temp' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/system32/config' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/system32/spool' > 2013/10/31 14:04:59 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/system32/CatRoot' > 2013/10/31 14:04:59 ossec-analysisd: INFO: White listing IP: '127.0.0.1' > 2013/10/31 14:04:59 ossec-analysisd: INFO: White listing IP: '192.168.1.111' > 2013/10/31 14:04:59 ossec-analysisd: INFO: White listing IP: '192.168.1.112' > 2013/10/31 14:04:59 ossec-analysisd: INFO: 3 IPs in the white list for active response. > 2013/10/31 14:04:59 ossec-analysisd: INFO: White listing Hostname: 'localhost.localdomain' > 2013/10/31 14:04:59 ossec-analysisd: INFO: 1 Hostname(s) in the white list for active response. > 2013/10/31 14:04:59 ossec-analysisd: INFO: Started (pid: 12836). > 2013/10/31 14:05:00 ossec-remoted(4111): INFO: Maximum number of agents allowed: '256'. > 2013/10/31 14:05:00 ossec-remoted(1410): INFO: Reading authentication keys file. > 2013/10/31 14:05:00 ossec-remoted: INFO: Assigning counter for agent myagent: '39:897'. > 2013/10/31 14:05:00 ossec-remoted: INFO: Assigning sender counter: 0:517 > 2013/10/31 14:05:00 ossec-monitord: INFO: Started (pid: 12856). > 2013/10/31 14:05:02 ossec-analysisd: INFO: Connected to '/queue/alerts/ar' (active-response queue) > 2013/10/31 14:05:02 ossec-analysisd: INFO: Connected to '/queue/alerts/execq' (exec queue) > 2013/10/31 14:05:04 ossec-syscheckd: INFO: Started (pid: 12852). > 2013/10/31 14:05:04 ossec-rootcheck: INFO: Started (pid: 12852). > 2013/10/31 14:05:04 ossec-syscheckd: INFO: Monitoring directory: '/etc'. > 2013/10/31 14:05:04 ossec-syscheckd: INFO: Monitoring directory: '/usr/bin'. > 2013/10/31 14:05:04 ossec-syscheckd: INFO: Monitoring directory: '/usr/sbin'. > 2013/10/31 14:05:04 ossec-syscheckd: INFO: Monitoring directory: '/bin'. > 2013/10/31 14:05:04 ossec-syscheckd: INFO: Monitoring directory: '/sbin'. > 2013/10/31 14:05:05 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/messages'. > 2013/10/31 14:05:05 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/secure'. > 2013/10/31 14:05:05 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/syslog'. > 2013/10/31 14:05:05 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/xferlog'. > 2013/10/31 14:05:05 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/maillog'. > 2013/10/31 14:05:05 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/httpd/error_log'. > 2013/10/31 14:05:05 ossec-logcollector(1950): INFO: Analyzing file: '/var/log/httpd/access_log'. > 2013/10/31 14:05:05 ossec-logcollector: INFO: Monitoring output of command(360): df -h > 2013/10/31 14:05:05 ossec-logcollector: INFO: Monitoring full output of command(360): netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort > 2013/10/31 14:05:05 ossec-logcollector: INFO: Monitoring full output of command(360): last -n 5 > 2013/10/31 14:05:05 ossec-logcollector: INFO: Started (pid: 12840). > 2013/10/31 14:05:06 ossec-dbd: INFO: Started (pid: 12819). > > Best Regards,. > > > On Thursday, October 31, 2013 11:47:50 AM UTC+7, dan (ddpbsd) wrote: >> >> >> On Oct 31, 2013 12:45 AM, "De Nguyen" <[email protected]> wrote: >> > >> > Dear Dan, >> > >> > Thanks or your support. >> > >> > I use ossec version 2.7 on Linux CentOS 5.8 32 bit. >> > I'm using ossec with apache 2.2.22, mysql 5.1.58, php 5.17 and Analogi 1.3 for monitor logging. >> > >> > If i use ossec with central syslog server on my server, can i resolve my solution ? and if answer is yes, which syslog server i can using (rsyslod, syslog-ng, etc...)? >> > >> >> Any standard syslogd should work fine. They should work for both collection of the logs for ossec to use, and for sending alerts to from ossec. >> >> > Please, give me some idea for this solution. >> > >> >> Provide the configuration. I can't tell why ossec-csyslogd is failing without it and hopefully the ossec.log entries. >> >> > Thanks again for your help ! >> > >> > Best Regards,. >> > >> > >> > On Thursday, October 31, 2013 11:12:26 AM UTC+7, dan (ddpbsd) wrote: >> >> >> >> >> >> On Oct 30, 2013 11:33 PM, "De Nguyen" <[email protected]> wrote: >> >> > >> >> > Dear all, >> >> > >> >> > I'm a newbie with ossec, after i install ossec & start them, the csyslogd not running on my ossec server (type server). The status like this: >> >> > ossec-monitord is running... >> >> > ossec-logcollector is running... >> >> > ossec-remoted is running... >> >> > ossec-syscheckd is running... >> >> > ossec-analysisd is running... >> >> > ossec-maild is running... >> >> > ossec-execd is running... >> >> > ossec-dbd is running... >> >> > ossec-csyslogd not running... >> >> > >> >> >> >> Csyslogd is the client syslog daemon. It's used for sending alerts to other systems via syslog. >> >> If that's what you are looking to do you should send your config. Also the version of ossec you're using and thr platform (os specifically). >> >> >> >> > I want monitor error and warning about hardware (RAID, HDD SCSI, RAM, etc...) from other servers and SMS for me when server have problem with hardware. So, can I use ossec software for my solution ? >> >> > >> >> > Many thanks for everyone have idea for my solution with open source software. >> >> > >> >> > Best Regards,. >> >> > >> >> > -- >> >> > >> >> > --- >> >> > You received this message because you are subscribed to the Google Groups "ossec-list" group. >> >> > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. >> >> >> >> > For more options, visit https://groups.google.com/groups/opt_out. >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. >> > For more options, visit https://groups.google.com/groups/opt_out. > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
