I've set OSSEC up to use the MySQL database to store everything; all looks fine, except for the vast majority of records in the "user" field (in the "data" table) are null. These are for operations/alerts which I would think certainly would be able to record the user; ie apt-get install shows all the various "install X package.." records, however the user name is null.
Am I correct to think that it should be recording the user name that I ran these commands as? If the system was ever compromised, I would want to be able to see this kind of data (who installed what) in the logs. Any ideas? thanks SYSTEM: ossec-hids-2.8.1 Debian 7 mysql-client-5.5 5.5.41-0+wheezy1 mysql-server 5.5.41-0+wheezy1 -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
