Good Morning Pedro,
Thank you for the help. Here is the <localfile> section in ossec.conf
containing the netstat command
<localfile>
<log_format>full_command</log_format>
<command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command>
</localfile>
When I execute that command in a shell, I get the full list of ports. I am
really not sure why the initial run - upon startup (?) is giving the
truncated list.
Unless...a thought just occurred to me. I looked in the rc.d directory for
the run level (e.g. 5) and see that Ossec starts at S20 whereas a lot of
the processes such as Postfix that opens the ports is starting up after
Ossec in which case it thinks that the ports have perpetually changed.
On Friday, April 15, 2016 at 6:18:38 AM UTC-4, Pedro S wrote:
>
> Hi Noway2,
>
> I just test it and it is working for me, could you paste your <localfile>
> section? You can open ossec.conf at OSSEC Manager search for "netstat" and
> paste that section here.
>
> The rule which trigger this alerts is:
>
> <rule id="533" level="7">
> <if_sid>530</if_sid>
> <match>ossec: output: 'netstat -tan</match>
> *<check_diff />*
> <description>Listened ports status (netstat) changed (new port opened
> or closed).</description>
> <group>pci_dss_10.2.7,pci_dss_10.6.1,</group>
> </rule>
>
>
> Regards,
>
> Pedro S.
>
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
