The part where you see 127.0.0.1 is the log collector checking if is there any new open port on netstat that wasn't open before... Also, if you are root, you don't need to be using sudo.
On the first email the ossec server was 172.20.21.43, and now you are saying that it should be 172.20.21.200... Make sure the server is properly configured on /var/ossec/etc/ossec.conf (<server-ip>172.20.21.200</server-ip>) On Wed, Nov 4, 2015 at 7:23 AM, Reinaldo Fernandes < [email protected]> wrote: > > > *I'm not sure about this 127.0.0.1 IP..Should it be the IP of ossec > server?If yes it should be 172.20.21.200.* > > quarta-feira, 4 de Novembro de 2015 às 09:21:30 UTC, Reinaldo Fernandes > escreveu: >> >> This is the logs result: >> >> >> -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
