Hi Dan,
thanks for your feedback.
The logs look like the extracted part I posted in the initial message.(it is
verbose mode)
The agent is configured by agent.conf in the following way.
<agent_config name="FTPSERVER">
<!-- One entry for each file/Event log to monitor. -->
<localfile>
<location>Security</location>
<log_format>eventlog</log_format>
</localfile>
<localfile>
<location>E:\SFTP_Logs\ActualLog.txt</location>
<log_format>syslog</log_format>
</localfile>
<!-- Syscheck - Integrity Checking config. -->
<syscheck>
<disabled>yes</disabled>
</syscheck>
<active-response>
<disabled>yes</disabled>
</active-response>
<rootcheck>
<disabled>yes</disabled>
</rootcheck>
<remote>
<connection>secure</connection>
</remote>
</agent_config>
With this configuration it worked the time before we changed the server which
is monitored.
regards,
Mirko
-----Ursprüngliche Nachricht-----
Von: [email protected] [mailto:[email protected]] Im
Auftrag von dan (ddp)
Gesendet: Freitag, 20. Juni 2014 14:08
An: [email protected]
Betreff: Re: [ossec-list] Problems parsing or sending Log to ossec server
On Thu, Jun 19, 2014 at 2:27 PM, <[email protected]> wrote:
> Hi everyone,
>
>
>
> I would appreciate to get help for the following problem.
>
> We have an ossec server and some windows server which are sending logs to
> ossec server for parsing different logs and send alerts in special events.
>
> Everything worked fine in the past.
>
> Now we had to change one system (hardware and OS).
>
> After that I installed the ossec agent in Version 2.6, 2.7 and 2.8 but the
> error is always the same.
>
> I cannot analyze a sftp log anymore which worked perfectly until the
> hardware and OS change.
>
> (We also monitor the security log of the windows server with ossec and this
> works fine too.)
>
>
>
> I turned on the verbose logging of the windows agent.
>
>
>
> Here you can see the extract with the messages:
>
>
>
> ------START-------
>
> 2014/06/18 14:29:26 ossec-agent(4102): INFO: Connected to the server
> (192.168.73.119:1514).
>
> 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive message.
>
> 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive: #!-Microsoft
> Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8 /
> 028689eeeb3413650c7684733309497c
>
> 1fde3118756ea021830f9edee6e410a1 merged.mg
>
>
>
> 2014/06/18 14:29:26 ossec-agent: INFO: System is Vista or newer (Microsoft
> Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8).
>
> 2014/06/18 14:29:26 ossec-agent: DEBUG: Entering LogCollectorStart().
>
> 2014/06/18 14:29:26 ossec-agent(1951): INFO: Analyzing event log:
> 'Security'.
>
> 2014/06/18 14:29:27 ossec-agent(1950): INFO: Analyzing file:
> 'E:\SFTP_Logs\ActualLog.txt'.
>
> 2014/06/18 14:29:27 ossec-agent: Message not complete. Trying again: 'ÿþ2'
>
> 2014/06/18 14:29:27 ossec-agent: INFO: Started (pid: 3800).
>
> 2014/06/18 14:29:31 ossec-agent: Message not complete. Trying again: 'ÿþ2'
>
> 2014/06/18 14:29:35 ossec-agent: Message not complete. Trying again: 'ÿþ2'
>
> 2014/06/18 14:29:39 ossec-agent: Message not complete. Trying again: 'ÿþ2'
>
> 2014/06/18 14:29:43 ossec-agent: Message not complete. Trying again: 'ÿþ2'
>
> 2014/06/18 14:29:47 ossec-agent: Message not complete. Trying again: 'ÿþ2'
>
> ------END-------
>
>
>
> I cannot see arriving the messages in archives.log on the ossec server but
> as I can see - the messages from the "ActualLog.txt" won't be send to the
> server.
>
> Reinstalled the agent, made a new agent on ossec server...but nothing worked.
>
>
>
> Do you have any suggestions?
>
>
How do you have it configured? Can you share the log file?
>
> Thanks in advance,
>
> Mirko
>
> Swiss Post Solutions GmbH
> Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser
> Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
Swiss Post Solutions GmbH
Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser
Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
