On Mon, Feb 9, 2015 at 7:25 AM, King Helix <[email protected]> wrote: > I've set OSSEC up to use the MySQL database to store everything; all looks > fine, except for the vast majority of records in the "user" field (in the > "data" table) are null. These are for operations/alerts which I would think > certainly would be able to record the user; ie apt-get install shows all the > various "install X package.." records, however the user name is null. > > > Am I correct to think that it should be recording the user name that I ran > these commands as? If the system was ever compromised, I would want to be > able to see this kind of data (who installed what) in the logs. >
No, it records the user decoded from the log message. > > Any ideas? > > > thanks > > > SYSTEM: > > ossec-hids-2.8.1 > > Debian 7 > > mysql-client-5.5 5.5.41-0+wheezy1 > > mysql-server 5.5.41-0+wheezy1 > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
