such a shame that WUI is no longer supported/developed. i understand that they rather focus on improving OSSEC than work on a web tool that displays the alerts. i understand that ELK (especially logstash and kibana) do the job nicely...
but WUI was the perfect pick for my thesis project (test environment) as I'm running the OSSEC appliance on a 2gb VM, and I don't have the possibility to add more RAM.. alas elasticsearch and logstash are a memory eating slug therefore I'm unable to run ELK on my test server... also it would be a bit overkill just for one OSSEC master and one agent. Am Samstag, 8. August 2015 22:49:16 UTC+2 schrieb Daniel: > > Interesting that ossec-wui isn't supported. I downloaded the appliance > right from ossec.net and was following the instructions. > > Went through my running processes and checked out their configs... sure > enough, kibana is also included. > > Opened up a browser to localhost:5601 and Kibana is still running like a > champ. Not even going to try to fix the wui since I'm more familiar with > ELK. > > Thanks for the help, Eero. > > On Saturday, August 8, 2015 at 4:31:42 PM UTC-4, Eero Volotinen wrote: >> >> Well, >> >> Check memory_limit on php also. >> >> Ossec wui is no longer supported. You should use kibana+elastic search >> instead of it. >> >> Eero >> >> Eero >> Thanks for the quick response. >> >> I chown'ed alerts.log from ossec.ossec to ossec.apache and still got the >> error. >> >> I then chmod'ed alerts.log from 640 to 666 and still got the error. >> >> Alerts.log is still growing, though. Up to 4.2G. >> >> On Saturday, August 8, 2015 at 3:29:32 PM UTC-4, Eero Volotinen wrote: >>> >>> Well, you need to give correct permissions to apache as wui is running >>> under apache uid.. >>> >>> Eeeo >>> 8.8.2015 8.27 ip. "Daniel Twardowski" <[email protected]> kirjoitti: >>> >>>> >>>> I'm using OSSEC Server Virtual Appliance 2.8.2 and last night I >>>> configured a few domain controllers to send it their logs. When I came in >>>> today, the WUI is displaying an error of: >>>> "Warning: fopen(/var/ossec/logs/alerts/alerts.log): failed to open >>>> stream: Value too large for defined data type in >>>> /opt/lampp/htdocs/ossec-wui/lib/os_lib_alerts.php on line 839" >>>> >>>> My alerts.log file is 3.5G. If I delete it and restart ossec services, >>>> the file is recreated at 3.5G. Is this an issue with file size? If so, can >>>> I up the log rotation to more than just once a day? And how would I flush >>>> whatever buffer keeps recreating the 3.5G alerts.log file so I can get >>>> back >>>> to reviewing logs? >>>> >>>> Similar, but unanswered message from 2013: >>>> >>>> https://groups.google.com/forum/#!msg/ossec-list/topCxSvvmBk/5t4YEfPTTYUJ >>>> >>>> Thanks. >>>> >>>> Dan >>>> >>>> -- >>>> >>>> --- >>>> You received this message because you are subscribed to the Google >>>> Groups "ossec-list" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to [email protected]. >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
