I grepped Category in the rules directory and only found the standard ones. Anywhere else I should search?
On Tuesday, December 2, 2014 3:04:06 PM UTC-5, dan (ddpbsd) wrote: > > On Tue, Dec 2, 2014 at 2:49 PM, Bill Price <[email protected] > <javascript:>> wrote: > > OSSEC HIDS v2.8 - Trend Micro Inc. > > > > On Tuesday, December 2, 2014 2:32:42 PM UTC-5, dan (ddpbsd) wrote: > >> > >> On Tue, Dec 2, 2014 at 2:29 PM, Bill Price <[email protected]> > wrote: > >> > I ran ossec-logtest > >> > > >> > >> You made no changes to the OSSEC rules or decoders? Very strange, I > >> haven't seen any other reports of this. What version of OSSEC did you > >> install? Is this a local installation or server? > >> > >> I'll start looking through the code to see where that error could have > >> come from. > >> > >> > On Tuesday, December 2, 2014 2:24:06 PM UTC-5, dan (ddpbsd) wrote: > >> >> > >> >> On Tue, Dec 2, 2014 at 2:22 PM, Bill Price <[email protected]> > >> >> wrote: > >> >> > I was asked to setup decoders and rules on a client. When I run > >> >> > ossec-test, > >> >> > I get the following error message: > >> >> > > >> >> > rules_list: Category '1' not found. Invalid 'category' > >> >> > > >> >> > All the Categories in the rules xml are the standard one (ids, > >> >> > syslog, > >> >> > firewall, web-log, squid, ossec or windows) > >> >> > > >> >> > Any ideas on what is wrong? > >> >> > > >> >> > >> >> What did you do? > >> >> > >> >> > -- > >> >> > > >> >> > --- > >> >> > You received this message because you are subscribed to the Google > >> >> > Groups > >> >> > "ossec-list" group. > >> >> > To unsubscribe from this group and stop receiving emails from it, > >> >> > send > >> >> > an > >> >> > email to [email protected]. > >> >> > For more options, visit https://groups.google.com/d/optout. > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups > >> > "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, > send > >> > an > >> > email to [email protected]. > >> > For more options, visit https://groups.google.com/d/optout. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > > Look for categories that are not: firewall, ids, syslog, web-log, > squid, windows, or ossec. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
