On Wed, Jun 4, 2014 at 12:21 PM, Up <[email protected]> wrote: > Hello guys, > > I just tried upgrade of ossec on my linux system(local) from > VERSION="v2.7.1"TYPE="local" to latest Latest Stable Release > (2.8)server/agent. But it seems there is no local type in it? > > After running ./install.sh (I chose yes to both questions), my TYPE="local" > got converted to TYPE="server" and ossec.log throws following message: >
Never heard of this. Anyone else seeing this issue? > 2014/06/04 11:06:28 ossec-execd(1225): INFO: SIGNAL Received. Exit > Cleaning... > 2014/06/04 11:06:30 ossec-testrule: INFO: Reading local decoder file. > 2014/06/04 11:06:30 ossec-analysisd: Invalid decoder name: 'bro-ids'. > 2014/06/04 11:06:30 ossec-testrule(1220): ERROR: Error loading the rules: > 'bro-ids_rules.xml'. > 2014/06/04 11:10:03 ossec-testrule: INFO: Reading local decoder file. > 2014/06/04 11:10:03 ossec-analysisd: Invalid decoder name: 'bro-ids'. > 2014/06/04 11:10:03 ossec-testrule(1220): ERROR: Error loading the rules: > 'bro-ids_rules.xml'. > > There is a 'bro-ids_rules.xml' in /var/ossec/rules > Yeah, that file went away. Delete the entry from the ossec.conf. > Please help! > > Thank you > Upen > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
