Wow you have a good point, maybe OSSEC is running netstat before some ports are open! I think OSSEC check diff only with the last output not "perpetually" from the first one, in case you can to check the last netstat output registered by OSSEC, cat the file:
/var/ossec/queue/diff/your-agent-or-ossec-manager-name/533/last-entry In case you want to test if the alerts are triggering, modify some port in "last-entry" file and reboot the manager/agent, instantly you will see the alert generated. For example I modified on last-entry file SSH port to 2222: ossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort': tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp6 0 0 ::1:25 :::* LISTEN tcp6 0 0 :::22 :::* LISTEN Previous output: ossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort': tcp 0 0 *0.0.0.0:2222 * 0.0.0.0:* LISTEN tcp6 0 0 ::1:25 :::* LISTEN tcp6 0 0 :::22 :::* LISTEN Regards, Pedro S. On Friday, April 15, 2016 at 3:41:21 PM UTC+2, Noway2 wrote: > > Good Morning Pedro, > > Thank you for the help. Here is the <localfile> section in ossec.conf > containing the netstat command > <localfile> > <log_format>full_command</log_format> > <command>netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort</command> > </localfile> > > When I execute that command in a shell, I get the full list of ports. I > am really not sure why the initial run - upon startup (?) is giving the > truncated list. > > Unless...a thought just occurred to me. I looked in the rc.d directory > for the run level (e.g. 5) and see that Ossec starts at S20 whereas a lot > of the processes such as Postfix that opens the ports is starting up after > Ossec in which case it thinks that the ports have perpetually changed. > > > On Friday, April 15, 2016 at 6:18:38 AM UTC-4, Pedro S wrote: >> >> Hi Noway2, >> >> I just test it and it is working for me, could you paste your <localfile> >> section? You can open ossec.conf at OSSEC Manager search for "netstat" and >> paste that section here. >> >> The rule which trigger this alerts is: >> >> <rule id="533" level="7"> >> <if_sid>530</if_sid> >> <match>ossec: output: 'netstat -tan</match> >> *<check_diff />* >> <description>Listened ports status (netstat) changed (new port opened >> or closed).</description> >> <group>pci_dss_10.2.7,pci_dss_10.6.1,</group> >> </rule> >> >> >> Regards, >> >> Pedro S. >> >> -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
