Hi,
I installed it. In the meantime I solved the problem with help from
Google:
https://unix.stackexchange.com/questions/200280/systemd-kills-service-immediately-after-start
Thanks for your help!
Best regards from Germany
Burkhard
Am 17.01.2020 um 13:12 schrieb dan (ddp):
On Mon, Jan 13, 2020 at 9:04 AM Schultheis Burkhard
<[email protected]> wrote:
Some weeks ago I've installed Ossec on on three servers. One is running
CentOS 6.10, the others Opensuse 15.1. The CentOS installation behaves
as expected, but the opensuse installations behave very different,
although the configurations are as close as possible.
From the CentOS server we get emails as expected, from the opensuse
servers not (other programs send us emails as expected from all
servers). The opensuse servers write tons of ossec logs, because it's in
a start-terminate loop. Excerpt:
How did you install OSSEC (package, source, etc)?
You could check the /var/log/audit/audit.log to see if it mentions
anything about it.
I have an OpenSuse VM where it worked fine, but I installed from
source. I haven't powered it up in a while though.
2020/01/13 13:45:25 ossec-testrule: INFO: Reading local decoder file.
2020/01/13 13:45:25 ossec-testrule: INFO: Started (pid: 28499).
2020/01/13 13:45:25 ossec-maild: INFO: Started (pid: 28516).
2020/01/13 13:45:25 ossec-execd: INFO: Started (pid: 28520).
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading local decoder file.
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'rules_config.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'pam_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'sshd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'telnetd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'syslog_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'arpwatch_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'symantec-av_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'symantec-ws_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'pix_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'named_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'smbd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'vsftpd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'pure-ftpd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'proftpd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'ms_ftpd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'ftpd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'hordeimp_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'roundcube_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'wordpress_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'cimserver_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'vpopmail_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'vmpop3d_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'courier_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'web_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'web_appsec_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'apache_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'nginx_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'php_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'mysql_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'postgresql_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'ids_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'squid_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'firewall_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'apparmor_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'cisco-ios_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'netscreenfw_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'sonicwall_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'postfix_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'sendmail_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'imapd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'mailscanner_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'dovecot_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'ms-exchange_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'racoon_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'vpn_concentrator_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'spamd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'msauth_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'mcafee_av_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'trend-osce_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'ms-se_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'zeus_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'solaris_bsm_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'vmware_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'ms_dhcp_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'asterisk_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'ossec_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'attack_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'openbsd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'clam_av_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'dropbear_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'sysmon_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'opensmtpd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'exim_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'openbsd-dhcpd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'dnsmasq_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'nsd_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Reading rules file:
'local_rules.xml'
2020/01/13 13:45:25 ossec-analysisd: INFO: Total rules enabled: '1603'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/mtab'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/mnttab'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/hosts.deny'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'/etc/mail/statistics'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/random-seed'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/adjtime'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/httpd/logs'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/utmpx'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/wtmpx'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/cups/certs'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: '/etc/dumpdates'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'/etc/svc/volatile'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/System32/LogFiles'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/Debug'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/WindowsUpdate.log'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/iis6.log'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/system32/wbem/Logs'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/system32/wbem/Repository'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/Prefetch'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/PCHEALTH/HELPCTR/DataColl'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/SoftwareDistribution'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/Temp'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/system32/config'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/system32/spool'
2020/01/13 13:45:25 ossec-analysisd: INFO: Ignoring file:
'C:\WINDOWS/system32/CatRoot'
2020/01/13 13:45:25 ossec-analysisd: INFO: Allow listing IP: '127.0.0.1'
2020/01/13 13:45:25 ossec-analysisd: INFO: Allow listing IP: 'xxxx'
2020/01/13 13:45:25 ossec-analysisd: INFO: Allow listing IP: 'xxxx'
2020/01/13 13:45:25 ossec-analysisd: INFO: Allow listing IP: 'xxxx'
2020/01/13 13:45:25 ossec-analysisd: INFO: 4 IPs in the allow list for
active response.
2020/01/13 13:45:25 ossec-analysisd: INFO: Allow listing Hostname: '::1'
2020/01/13 13:45:25 ossec-analysisd: INFO: Allow listing Hostname:
'localhost.localdomain'
2020/01/13 13:45:25 ossec-analysisd: INFO: 2 Hostname(s) in the allow
list for active response.
2020/01/13 13:45:25 ossec-analysisd: INFO: Started (pid: 28524).
2020/01/13 13:45:26 ossec-monitord: INFO: Started (pid: 28536).
2020/01/13 13:45:28 ossec-monitord(1225): INFO: SIGNAL
[(15)-(Terminated)] Received. Exit Cleaning...
2020/01/13 13:45:28 ossec-logcollector(1225): INFO: SIGNAL
[(15)-(Terminated)] Received. Exit Cleaning...
2020/01/13 13:45:28 ossec-analysisd(1225): INFO: SIGNAL
[(15)-(Terminated)] Received. Exit Cleaning...
2020/01/13 13:45:28 ossec-maild(1225): INFO: SIGNAL [(15)-(Terminated)]
Received. Exit Cleaning...
2020/01/13 13:45:28 ossec-execd(1314): INFO: Shutdown received. Deleting
responses.
2020/01/13 13:45:28 ossec-execd(1225): INFO: SIGNAL [(15)-(Terminated)]
Received. Exit Cleaning...
Where should I look what could terminate the process?
Best regards
Burkhard
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/ossec-list/2f6a0b29-db32-1a1a-8a67-e031ce24bab3%40gmail.com.
--
---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/ossec-list/ad0e5dd2-d662-966d-ea62-1c0f6faa531a%40gmail.com.
