I've been trying to setup policy audit in a lab I've set up to no avail.
My setup is 2 servers (server, client) using CentOS 7.3 and RPMs from the
atomic repository (selinux, firewalld are disabled) (ipv6 is enabled)
All server processes are up and running:
*[root@ossec-server ossec]# bin/ossec-control status*
*ossec-monitord is running...*
*ossec-logcollector is running...*
*ossec-remoted is running...*
*ossec-syscheckd is running...*
*ossec-analysisd is running...*
*ossec-maild is running...*
*ossec-execd is running...*
*ossec-dbd is running...*
client enrolled via manage_agents and I can see it registered and active:
*[root@ossec-server ossec]# bin/agent_control -i 001*
*OSSEC HIDS agent_control. Agent information:*
* Agent ID: 001*
* Agent Name: ossec-client.infosec*
* IP address: 172.16.29.6/32*
* Status: Active*
* Operating system: Linux ossec-client.infosec
3.10.0-514.10.2.el7.x86_64 #1 SMP Fri Mar 3 00:04:05 UTC 2017 x86_64*
* Client version: OSSEC HIDS v2.9.0 /
9fd969bbe7f4a3f52951a3e3acb1953b*
* Last keep alive: Tue Mar 28 23:09:30 2017*
* Syscheck last started at: Tue Mar 28 23:00:35 2017*
* Rootcheck last started at: Tue Mar 28 22:41:41 2017*
here is my agent.conf:
<agent_config os="Linux">
<syscheck>
<!-- Frequency that syscheck is executed - default to every 22 hours -->
<frequency>3600</frequency>
<!-- Directories to check (perform all possible verifications) -->
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories check_all="yes">/bin,/sbin</directories>
<!-- Files/directories to ignore -->
<ignore>/etc/mtab</ignore>
<ignore>/etc/mnttab</ignore>
<ignore>/etc/hosts.deny</ignore>
<ignore>/etc/mail/statistics</ignore>
<ignore>/etc/random-seed</ignore>
<ignore>/etc/adjtime</ignore>
<ignore>/etc/httpd/logs</ignore>
<ignore>/etc/utmpx</ignore>
<ignore>/etc/wtmpx</ignore>
<ignore>/etc/cups/certs</ignore>
<ignore>/etc/dumpdates</ignore>
<ignore>/etc/svc/volatile</ignore>
</syscheck>
<!-- Files to monitor (localfiles) -->
<localfile>
<log_format>syslog</log_format>
<location>/var/log/messages</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/secure</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/maillog</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/log/yum.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/ossec/logs/active-responses.log</location>
</localfile>
<rootcheck>
<rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
<rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
<system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
<system_audit>/var/ossec/etc/shared/cis_rhel7_linux_rcl.txt</system_audit>
</rootcheck>
</agent_config>
MD5 matches between /var/ossec/etc/shared/agent.conf and the client version
I get from *bin/agent_control -i 001*
However I'm not getting any results from the system_audit.
What am I doing wrong?
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
