Hi everyone, I would appreciate to get help for the following problem. We have an ossec server and some windows server which are sending logs to ossec server for parsing different logs and send alerts in special events. Everything worked fine in the past. Now we had to change one system (hardware and OS). After that I installed the ossec agent in Version 2.6, 2.7 and 2.8 but the error is always the same. I cannot analyze a sftp log anymore which worked perfectly until the hardware and OS change. (We also monitor the security log of the windows server with ossec and this works fine too.)
I turned on the verbose logging of the windows agent. Here you can see the extract with the messages: ------START------- 2014/06/18 14:29:26 ossec-agent(4102): INFO: Connected to the server (192.168.73.119:1514). 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive message. 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive: #!-Microsoft Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8 / 028689eeeb3413650c7684733309497c 1fde3118756ea021830f9edee6e410a1 merged.mg 2014/06/18 14:29:26 ossec-agent: INFO: System is Vista or newer (Microsoft Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8). 2014/06/18 14:29:26 ossec-agent: DEBUG: Entering LogCollectorStart(). 2014/06/18 14:29:26 ossec-agent(1951): INFO: Analyzing event log: 'Security'. 2014/06/18 14:29:27 ossec-agent(1950): INFO: Analyzing file: 'E:\SFTP_Logs\ActualLog.txt'. 2014/06/18 14:29:27 ossec-agent: Message not complete. Trying again: 'ÿþ2' 2014/06/18 14:29:27 ossec-agent: INFO: Started (pid: 3800). 2014/06/18 14:29:31 ossec-agent: Message not complete. Trying again: 'ÿþ2' 2014/06/18 14:29:35 ossec-agent: Message not complete. Trying again: 'ÿþ2' 2014/06/18 14:29:39 ossec-agent: Message not complete. Trying again: 'ÿþ2' 2014/06/18 14:29:43 ossec-agent: Message not complete. Trying again: 'ÿþ2' 2014/06/18 14:29:47 ossec-agent: Message not complete. Trying again: 'ÿþ2' ------END------- I cannot see arriving the messages in archives.log on the ossec server but as I can see - the messages from the "ActualLog.txt" won't be send to the server. Reinstalled the agent, made a new agent on ossec server...but nothing worked. Do you have any suggestions? Thanks in advance, Mirko Swiss Post Solutions GmbH Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
