Finally I found the problem. The new server had the option to use Unicode formatted logfile in SFTP log configuration, this was new in this version and activated by default. After deactivating, log rotate and starting ossec-agent again, the file is parsed as it should be.
regards, Mirko -----Ursprüngliche Nachricht----- Von: [email protected] [mailto:[email protected]] Im Auftrag von Hainke Mirko, SPS Global Services Gesendet: Freitag, 20. Juni 2014 15:17 An: [email protected] Betreff: AW: [ossec-list] Problems parsing or sending Log to ossec server To deliver a log here is quite difficult not to say impossible due to security restrictions in our company. I really know it would be much better to have the whole log (approx. 400MByte each day) but in the log there is the whole data exchange with all of our customers via sftp readable (accounts, external ips, paths and so on) Here's the format of the logfile if this helps a bit: #Fields: date time s-ip s-port x-ssocket c-ip c-port x-csocket cs-username cs-bytes sc-bytes cs-uri-stem sc-status Message And this is one of the lines we're looking for: 2014-06-19 22:57:04 10.0.0.72 22 0 35.24.60.206 38573 3824 root 0 0 - 38 User "root" not found; returning 530 regards, Mirko -----Ursprüngliche Nachricht----- Von: [email protected] [mailto:[email protected]] Im Auftrag von dan (ddp) Gesendet: Freitag, 20. Juni 2014 14:30 An: [email protected] Betreff: Re: [ossec-list] Problems parsing or sending Log to ossec server On Fri, Jun 20, 2014 at 8:23 AM, <[email protected]> wrote: > Hi Dan, > > thanks for your feedback. > > The logs look like the extracted part I posted in the initial message.(it is > verbose mode) I meant the log file you're trying to monitor. Hopefully someone would be able to use that to track down what's going wrong. > The agent is configured by agent.conf in the following way. > > <agent_config name="FTPSERVER"> > <!-- One entry for each file/Event log to monitor. --> > > <localfile> > <location>Security</location> > <log_format>eventlog</log_format> > </localfile> > > <localfile> > <location>E:\SFTP_Logs\ActualLog.txt</location> > <log_format>syslog</log_format> > </localfile> > > <!-- Syscheck - Integrity Checking config. --> > <syscheck> > <disabled>yes</disabled> > </syscheck> > > <active-response> > <disabled>yes</disabled> > </active-response> > > <rootcheck> > <disabled>yes</disabled> > </rootcheck> > > <remote> > <connection>secure</connection> > </remote> > > </agent_config> > > With this configuration it worked the time before we changed the server which > is monitored. > > regards, > Mirko > > -----Ursprüngliche Nachricht----- > Von: [email protected] [mailto:[email protected]] Im > Auftrag von dan (ddp) > Gesendet: Freitag, 20. Juni 2014 14:08 > An: [email protected] > Betreff: Re: [ossec-list] Problems parsing or sending Log to ossec server > > On Thu, Jun 19, 2014 at 2:27 PM, <[email protected]> wrote: >> Hi everyone, >> >> >> >> I would appreciate to get help for the following problem. >> >> We have an ossec server and some windows server which are sending logs to >> ossec server for parsing different logs and send alerts in special events. >> >> Everything worked fine in the past. >> >> Now we had to change one system (hardware and OS). >> >> After that I installed the ossec agent in Version 2.6, 2.7 and 2.8 but the >> error is always the same. >> >> I cannot analyze a sftp log anymore which worked perfectly until the >> hardware and OS change. >> >> (We also monitor the security log of the windows server with ossec and this >> works fine too.) >> >> >> >> I turned on the verbose logging of the windows agent. >> >> >> >> Here you can see the extract with the messages: >> >> >> >> ------START------- >> >> 2014/06/18 14:29:26 ossec-agent(4102): INFO: Connected to the server >> (192.168.73.119:1514). >> >> 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive message. >> >> 2014/06/18 14:29:26 ossec-agent: DEBUG: Sending keep alive: #!-Microsoft >> Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8 / >> 028689eeeb3413650c7684733309497c >> >> 1fde3118756ea021830f9edee6e410a1 merged.mg >> >> >> >> 2014/06/18 14:29:26 ossec-agent: INFO: System is Vista or newer (Microsoft >> Windows Server 2012 Standard Edition (Build 9200) - OSSEC HIDS v2.8). >> >> 2014/06/18 14:29:26 ossec-agent: DEBUG: Entering LogCollectorStart(). >> >> 2014/06/18 14:29:26 ossec-agent(1951): INFO: Analyzing event log: >> 'Security'. >> >> 2014/06/18 14:29:27 ossec-agent(1950): INFO: Analyzing file: >> 'E:\SFTP_Logs\ActualLog.txt'. >> >> 2014/06/18 14:29:27 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:27 ossec-agent: INFO: Started (pid: 3800). >> >> 2014/06/18 14:29:31 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:35 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:39 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:43 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> 2014/06/18 14:29:47 ossec-agent: Message not complete. Trying again: 'ÿþ2' >> >> ------END------- >> >> >> >> I cannot see arriving the messages in archives.log on the ossec server but >> as I can see - the messages from the "ActualLog.txt" won't be send to the >> server. >> >> Reinstalled the agent, made a new agent on ossec server...but nothing worked. >> >> >> >> Do you have any suggestions? >> >> > > How do you have it configured? Can you share the log file? > >> >> Thanks in advance, >> >> Mirko >> >> Swiss Post Solutions GmbH >> Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser >> Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > Swiss Post Solutions GmbH > Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser > Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout. Swiss Post Solutions GmbH Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout. Swiss Post Solutions GmbH Geschäftsführer: Michael Auerbach, Stefan Nowack, Frank-Michael Pácser Registergericht Bamberg HRB 110, USt-IdNr.: DE 132 268 861 -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
