Hi Kai, did you find a solution to your issue? If not, could you copy/paste your configuration/tests, not sure I understand everything you said.
On Tue, Mar 8, 2016 at 9:51 PM, Kai <[email protected]> wrote: > Hi, > > I have a strange problem which I can't solve. > OSSEC v8.2.3 is working fine, active respone for apache, ssh and other > services is working without problems. > > IPtables logs are written to a file calles iptables.log using rsyslogd. > Analyzing the file using the ossec-logtest works and shows the correct > decoding, piping this to the ossec-reportd shows that everything is finde > and scans / drops are detected and the correct rules are matched. > Turning on the debug mode in ossec also shows that the log is analyzed. > However: firewall.log stays empty (option is set to 1) and there are no > alerts for drops in iptables.log (I removed the no_log option from the > rule). Also if I do a nmap scan nothing happens. > > any ideas? > > thanks > Kai > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
