On Thu, Jun 19, 2014 at 2:27 PM, <[email protected]> wrote: > Hi everyone, > > > > I would appreciate to get help for the following problem. > > We have an ossec server and some windows server which are sending logs to > ossec server for parsing different logs and send alerts in special events. > > Everything worked fine in the past. > > Now we had to change one system (hardware and OS). > > After that I installed the ossec agent in Version 2.6, 2.7 and 2.8 but the > error is always the same. > > I cannot analyze a sftp log anymore which worked perfectly until the > hardware and OS change. > > (We also monitor the security log of the windows server with ossec and this > works fine too.) > > > > I turned on the verbose logging of the windows agent. > > > > Here you can see the extract with the messages: > > > > ------START------- > > 2014/06/18 14:29:26 ossec-agent(4102): INFO: Connected to the server > (192.168.73.119:1514). > > 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive message. > > 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive: #!-Microsoft > Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8 / > 028689eeeb3413650c7684733309497c > > 1fde3118756ea021830f9edee6e410a1 merged.mg > > > > 2014/06/18 14:29:26 ossec-agent: INFO: System is Vista or newer (Microsoft > Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8). > > 2014/06/18 14:29:26 ossec-agent: DEBUG: Entering LogCollectorStart(). > > 2014/06/18 14:29:26 ossec-agent(1951): INFO: Analyzing event log: > 'Security'. > > 2014/06/18 14:29:27 ossec-agent(1950): INFO: Analyzing file: > 'E:\SFTP_Logs\ActualLog.txt'. > > 2014/06/18 14:29:27 ossec-agent: Message not complete. Trying again: 'ÿþ2' > > 2014/06/18 14:29:27 ossec-agent: INFO: Started (pid: 3800). > > 2014/06/18 14:29:31 ossec-agent: Message not complete. Trying again: 'ÿþ2' > > 2014/06/18 14:29:35 ossec-agent: Message not complete. Trying again: 'ÿþ2' > > 2014/06/18 14:29:39 ossec-agent: Message not complete. Trying again: 'ÿþ2' > > 2014/06/18 14:29:43 ossec-agent: Message not complete. Trying again: 'ÿþ2' > > 2014/06/18 14:29:47 ossec-agent: Message not complete. Trying again: 'ÿþ2' > > ------END------- > > > > I cannot see arriving the messages in archives.log on the ossec server but > as I can see - the messages from the "ActualLog.txt" won't be send to the > server. > > Reinstalled the agent, made a new agent on ossec server...but nothing worked. > > > > Do you have any suggestions? > >
How do you have it configured? Can you share the log file? > > Thanks in advance, > > Mirko > > Swiss Post Solutions GmbH > Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser > Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
