On Fri, Jun 20, 2014 at 8:23 AM, <[email protected]> wrote: > Hi Dan, > > thanks for your feedback. > > The logs look like the extracted part I posted in the initial message.(it is > verbose mode)
I meant the log file you're trying to monitor. Hopefully someone would be able to use that to track down what's going wrong. > The agent is configured by agent.conf in the following way. > > <agent_config name="FTPSERVER"> > <!-- One entry for each file/Event log to monitor. --> > > <localfile> > <location>Security</location> > <log_format>eventlog</log_format> > </localfile> > > <localfile> > <location>E:\SFTP_Logs\ActualLog.txt</location> > <log_format>syslog</log_format> > </localfile> > > <!-- Syscheck - Integrity Checking config. --> > <syscheck> > <disabled>yes</disabled> > </syscheck> > > <active-response> > <disabled>yes</disabled> > </active-response> > > <rootcheck> > <disabled>yes</disabled> > </rootcheck> > > <remote> > <connection>secure</connection> > </remote> > > </agent_config> > > With this configuration it worked the time before we changed the server which > is monitored. > > regards, > Mirko > > -----Ursprüngliche Nachricht----- > Von: [email protected] [mailto:[email protected]] Im > Auftrag von dan (ddp) > Gesendet: Freitag, 20. Juni 2014 14:08 > An: [email protected] > Betreff: Re: [ossec-list] Problems parsing or sending Log to ossec server > > On Thu, Jun 19, 2014 at 2:27 PM, <[email protected]> wrote: >> Hi everyone, >> >> >> >> I would appreciate to get help for the following problem. >> >> We have an ossec server and some windows server which are sending logs to >> ossec server for parsing different logs and send alerts in special events. >> >> Everything worked fine in the past. >> >> Now we had to change one system (hardware and OS). >> >> After that I installed the ossec agent in Version 2.6, 2.7 and 2.8 but the >> error is always the same. >> >> I cannot analyze a sftp log anymore which worked perfectly until the >> hardware and OS change. >> >> (We also monitor the security log of the windows server with ossec and this >> works fine too.) >> >> >> >> I turned on the verbose logging of the windows agent. >> >> >> >> Here you can see the extract with the messages: >> >> >> >> ------START------- >> >> 2014/06/18 14:29:26 ossec-agent(4102): INFO: Connected to the server >> (192.168.73.119:1514). >> >> 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive message. >> >> 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive: #!-Microsoft >> Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8 / >> 028689eeeb3413650c7684733309497c >> >> 1fde3118756ea021830f9edee6e410a1 merged.mg >> >> >> >> 2014/06/18 14:29:26 ossec-agent: INFO: System is Vista or newer (Microsoft >> Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8). >> >> 2014/06/18 14:29:26 ossec-agent: DEBUG: Entering LogCollectorStart(). >> >> 2014/06/18 14:29:26 ossec-agent(1951): INFO: Analyzing event log: >> 'Security'. >> >> 2014/06/18 14:29:27 ossec-agent(1950): INFO: Analyzing file: >> 'E:\SFTP_Logs\ActualLog.txt'. >> >> 2014/06/18 14:29:27 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:27 ossec-agent: INFO: Started (pid: 3800). >> >> 2014/06/18 14:29:31 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:35 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:39 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:43 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:47 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> ------END------- >> >> >> >> I cannot see arriving the messages in archives.log on the ossec server but >> as I can see - the messages from the "ActualLog.txt" won't be send to the >> server. >> >> Reinstalled the agent, made a new agent on ossec server...but nothing worked. >> >> >> >> Do you have any suggestions? >> >> > > How do you have it configured? Can you share the log file? > >> >> Thanks in advance, >> >> Mirko >> >> Swiss Post Solutions GmbH >> Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser >> Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > Swiss Post Solutions GmbH > Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser > Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
