On Mon, Nov 2, 2015 at 4:21 AM, Hak Bun <[email protected]> wrote: > Dear All, > > Could anyone advice for this? >
Turn on the log all option on the manager. Restart the OSSEC processes on the manager. Fail to login to a Windows agent. Check the /var/ossec/logs/archives/archives.log file for the failed authentication attempt. Please provide us with the log message in the archives.log file. (You can replace usernames with USERNAME, and IP addresses with something like 10.10.10.X (replacing X with a different number for each different IP seen in the log)) > Thanks in advance. > Hak > > On Fri, Oct 23, 2015 at 10:48 AM, Hak Bun <[email protected]> wrote: >> >> Dear All, >> >> How can I set alert for authentication failure attempt in windows? >> >> Thanks in advance for your comment. >> Hak > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
