Hi I am new to ossec and I'm testing to see if I can use ossec to monitor the log on my DDP(http://ddpsan.com/)
I've installed ossec as a VMware Appliance on ESXi 6. Seems to be working as it should. The agents work on linux, windows and Apple OS X, so everything is almost fine. My only problem, and the main reason for trying ossec is to monitor my DDP without the need to install anything. When I type "cat /etc/issue" in the CLI I get: *Debian GNU/Linux 4.0 \n \l* and when I type "uname -a" I get: *Linux head-postyr 2.6.28.14-ddp-etch64 #72 SMP Fri Jun 28 14:43:11 CEST 2013 x86_64 GNU/Linux* The DDP has 10 NICs and I am using eth9 with IP: 10.0.0.4 It has syslog and I have written this in the bottom of my /etc/syslog.conf file: *#IP of the ossec server* **.* @10.0.0.185* On my ossec server I have added these lines to /var/ossec/etc/ossec.conf: *#IP of the DDP.* *<global>* * <white_list>10.0.0.4</white_list>* *</global>* *<remote>* * <connection>syslog</connection>* * <allowed-ips>10.0.0.4</allowed-ips>* * </remote>* * <remote>* * <connection>secure</connection>* * </remote>* I've also tried adding the DDP through /var/ossec/bin/manage_agents: *ID: 004, Name: ddp, IP: 10.0.0.4* And when I restart the ossec server and look at the log I see these lines: *2015/10/20 02:10:10 ossec-remoted: Remote syslog allowed from: '10.0.0.4'* *2015/10/20 02:10:10 ossec-analysisd: INFO: White listing IP: '10.0.0.4'* And I get any errors. When I go to the kibana site to try and search for the DDP log I see nothing. (Only that I tried SSH from ossec to ddp) What am I doing wrong? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
