On Tue, Dec 2, 2014 at 3:21 PM, Bill Price <[email protected]> wrote: > I grepped Category in the rules directory and only found the standard ones. > Anywhere else I should search? > > On Tuesday, December 2, 2014 3:04:06 PM UTC-5, dan (ddpbsd) wrote: >> >> On Tue, Dec 2, 2014 at 2:49 PM, Bill Price <[email protected]> wrote: >> > OSSEC HIDS v2.8 - Trend Micro Inc. >> > >> > On Tuesday, December 2, 2014 2:32:42 PM UTC-5, dan (ddpbsd) wrote: >> >> >> >> On Tue, Dec 2, 2014 at 2:29 PM, Bill Price <[email protected]> >> >> wrote: >> >> > I ran ossec-logtest >> >> > >> >> >> >> You made no changes to the OSSEC rules or decoders? Very strange, I >> >> haven't seen any other reports of this. What version of OSSEC did you >> >> install? Is this a local installation or server? >> >> >> >> I'll start looking through the code to see where that error could have >> >> come from. >> >>
At this point I'd probably copy the contents of the rules directory as a backup, and put fresh copies of the files in place. >> >> > On Tuesday, December 2, 2014 2:24:06 PM UTC-5, dan (ddpbsd) wrote: >> >> >> >> >> >> On Tue, Dec 2, 2014 at 2:22 PM, Bill Price <[email protected]> >> >> >> wrote: >> >> >> > I was asked to setup decoders and rules on a client. When I run >> >> >> > ossec-test, >> >> >> > I get the following error message: >> >> >> > >> >> >> > rules_list: Category '1' not found. Invalid 'category' >> >> >> > >> >> >> > All the Categories in the rules xml are the standard one (ids, >> >> >> > syslog, >> >> >> > firewall, web-log, squid, ossec or windows) >> >> >> > >> >> >> > Any ideas on what is wrong? >> >> >> > >> >> >> >> >> >> What did you do? >> >> >> >> >> >> > -- >> >> >> > >> >> >> > --- >> >> >> > You received this message because you are subscribed to the Google >> >> >> > Groups >> >> >> > "ossec-list" group. >> >> >> > To unsubscribe from this group and stop receiving emails from it, >> >> >> > send >> >> >> > an >> >> >> > email to [email protected]. >> >> >> > For more options, visit https://groups.google.com/d/optout. >> >> > >> >> > -- >> >> > >> >> > --- >> >> > You received this message because you are subscribed to the Google >> >> > Groups >> >> > "ossec-list" group. >> >> > To unsubscribe from this group and stop receiving emails from it, >> >> > send >> >> > an >> >> > email to [email protected]. >> >> > For more options, visit https://groups.google.com/d/optout. >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. >> >> Look for categories that are not: firewall, ids, syslog, web-log, >> squid, windows, or ossec. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
