Looks to be working. I added the home directory (again on my test server, though production is very similar) and it caught the bash history changing when I logged out of one of the agent servers.
** Alert 1458747452.33878: mail - ossec,syscheck, 2016 Mar 23 15:37:32 (al2) 10.20.0.10->syscheck Rule: 552 (level 7) -> 'Integrity checksum changed again (3rd time).' Integrity checksum changed for: '/home/ec2-user/.bash_history' On Wednesday, March 23, 2016 at 10:53:29 AM UTC-4, thak wrote: > > Yeah, somehow I am JUST now realizing that it has to be explicitly added > in as an option for the <directories> definitions. D'oh. > > 2016/03/23 14:44:40 ossec-syscheckd: INFO: Initializing real time file > monitoring (not started). > 2016/03/23 14:48:15 ossec-syscheckd: INFO: Real time file monitoring > started. > > Got it now. > > On Wednesday, March 23, 2016 at 10:41:40 AM UTC-4, dan (ddpbsd) wrote: >> >> On Wed, Mar 23, 2016 at 10:30 AM, thak <[email protected]> wrote: >> > Thank you for the suggestions! >> > >> > We definitely have the /var/application hashes in the manager's >> > /var/ossec/queue/syscheck files. >> > >> > So it's definitely picking them up, just does not seem to be alerting >> or >> > emailing. On my test instance I also cannot seem to get realtime >> alerting >> > working. I know I enabled it during installation, I think, but it does >> not >> > seem to detect in realtime (despite inotify-tools being installed). >> > >> >> Turn off the auto ignore option, see if alerts are generated then. >> Make sure you have the realtime="yes" option set in your <directories> >> blocks in the ossec.conf. Realtime detection does not happen >> automatically just because the feature is present, you have to >> explicitly enable it. >> >> > >> > >> > On Monday, March 21, 2016 at 8:09:01 PM UTC-4, Santiago Bassett wrote: >> >> >> >> Some questions that might help: >> >> >> >> - did you restart the agent after changing the configuration? >> (required, >> >> unless it is pushed from the manager using shared agent.conf file) >> >> >> >> - did you specify the frequency of the checks? Most cases alerts are >> not >> >> generated in real time. Even when using realtime option, it might take >> a few >> >> minutes (could be about 5-10 minutes) to get the alert (this happens >> when >> >> rootcheck is running) >> >> >> >> - did you get the file hashes listed in syscheck database (see >> >> /var/ossec/queue/sysechck directory)? >> >> >> >> - did you configure the manager to alert for new files? (and also the >> >> rule) >> >> >> >> - did you set auto_ignore option to no? (in case the file has been >> >> modified more than three times) >> >> >> >> Also I would recommend to use scan_on start option in the agent. >> >> >> >> I hope that helps, >> >> >> >> Santiago. >> >> >> >> On Wed, Mar 16, 2016 at 2:02 PM, thak <[email protected]> wrote: >> >>> >> >>> Hi, >> >>> >> >>> We added /var/application directories to our application servers' >> >>> ossec.conf file, but we just rolled an application update >> (introducing new >> >>> files and absolutely modifying older ones) and didn't get any >> updates. >> >>> >> >>> Any ideas on a likely issue here? Do we need to run the command to >> clear >> >>> the syscheck file integrity database? Is there some requirement that >> OSSEC >> >>> "rebaseline" the integrity hashes, such that they pick up this new >> rule's >> >>> target directories? >> >>> >> >>> -- >> >>> >> >>> --- >> >>> You received this message because you are subscribed to the Google >> Groups >> >>> "ossec-list" group. >> >>> To unsubscribe from this group and stop receiving emails from it, >> send an >> >>> email to [email protected]. >> >>> For more options, visit https://groups.google.com/d/optout. >> >> >> >> >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
