On Tue, Nov 13, 2018 at 8:24 AM Bummi <[email protected]> wrote: > > Thank you, Zack. > > When is the daily reporting functionality being removed? >
It's not official yet. The pull request hasn't been accepted. I imagine we'll have 3.2 before (if) it gets removed. > > -b > > On Wednesday, November 7, 2018 at 5:38:15 PM UTC-8, Zack Vanderbilt wrote: >> >> The daily reporting functionality is being removed. I suggest you implement >> via script and cron. >> >> ie >> >> cat /var/ossec/logs/alerts/alerts.log | /var/ossec/bin/ossec-reportd -f >> group syscheck -r location filename -n "File Modifications" > >> /tmp/daily_syscheck.txt 2>&1 >> >> mail -s "Daily Syscheck Report" -a /tmp/daily_syscheck.txt [email protected] >> >> >> >> On Thursday, October 25, 2018 at 12:41:47 PM UTC-7, Bummi wrote: >>> >>> Hello! >>> >>> I am not getting daily reports emailed to me. Regular email alerts seems to >>> work just fine. >>> >>> Here is my current configuration: >>> >>> <alerts> >>> <log_alert_level>2</log_alert_level> >>> <email_alert_level>10</email_alert_level> >>> </alerts> >>> >>> <reports> >>> <level>10</level> >>> <title>Daily report: Alerts with level higher than 10</title> >>> <email_to>[email protected]</email_to> >>> <group>syscheck</group> >>> <title>Daily report: File changes</title> >>> <email_to>[email protected]</email_to> >>> <rule>554</rule> >>> <title>Daily report: File added to system</title> >>> <email_to>[email protected]</email_to> >>> </reports> >>> >>> >>> >>> >>> I see this in my ossec-monitord logs for the level 10 report but nothing >>> for the SYSCHECK or 554 report. I don't have any alerts higher than level >>> 10 so I understand that this particular report will not be sent. >>> >>> 2018-10-25 00:00:16 | ossec-monitord | info | Report 'Daily report: Alerts >>> with level higher than 10' completed and zero alerts post-filter. >>> 2018-10-25 00:00:16 | ossec-monitord | info | Report 'Daily report: Alerts >>> with level higher than 10' empty. >>> 2018-10-25 00:00:11 | ossec-monitord | info | Starting new log after >>> rotation. >>> 2018-10-25 00:00:11 | ossec-monitord | info | Starting daily reporting for >>> 'Daily report: Alerts with level higher than 10' >>> I understand that reports run at midnight. Is there a way to force run them >>> for testing purposes? >>> >>> Thanks, >>> >>> -r > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
