Re: [ossec-list] Re: I cannot monitor my ASA 5520 by using OSSEC

2015-02-13 Thread dan (ddp)
On Fri, Feb 13, 2015 at 10:06 AM, Network Infrastructure panhatiger...@gmail.com wrote: When I run ifconfig it show my ossec manager IP address eth0 and loopback. eth0 it is. So run: `tcpdump -i eth0 -nnXxevvvs 0 port 2514 and host 192.168.10.1` on the OSSEC manager. This should show you

[ossec-list] Re: I cannot monitor my ASA 5520 by using OSSEC

2015-02-13 Thread Network Infrastructure
I am sorry, if i make a mistake because i don't know much about English. On Friday, February 6, 2015 at 9:11:33 AM UTC+7, Network Infrastructure wrote: I have configured OSSEC to monitor my ASA 5520 but I cannot see anything In ASA 5520, I enable syslog server to send syslog to my OSSEC

Re: [ossec-list] Re: I cannot monitor my ASA 5520 by using OSSEC

2015-02-13 Thread dan (ddp)
On Thu, Feb 12, 2015 at 9:24 PM, Network Infrastructure panhatiger...@gmail.com wrote: IP 192.168.10.1 is the ip of my asa Removing all of the context for your responses is kinda rude. Did you run the ifconfig command on the OSSEC manager? If it isn't present, try: `ip addr` On Friday,

[ossec-list] Re: I cannot monitor my ASA 5520 by using OSSEC

2015-02-13 Thread Network Infrastructure
When I run ifconfig it show my ossec manager IP address eth0 and loopback. help me! I really need it. On Friday, February 6, 2015 at 9:11:33 AM UTC+7, Network Infrastructure wrote: I have configured OSSEC to monitor my ASA 5520 but I cannot see anything In ASA 5520, I enable syslog

Re: [ossec-list] check_diff

2015-02-13 Thread dan (ddp)
Just as a heads up, I tested the check_diff option and it seems to be working with just the last-entry files. On Fri, Feb 13, 2015 at 8:32 AM, dan (ddp) ddp...@gmail.com wrote: On Fri, Feb 13, 2015 at 8:26 AM, alex petrov allreadypa...@gmail.com wrote: I tested it, I need the files with

Re: [ossec-list] check_diff

2015-02-13 Thread alex petrov
I tested it, I need the files with changes. HOW TO Disable /var/ossec/queue/diff/*state.$epoch files? IN ossec 2.7 This function was enable/ четверг, 12 февраля 2015 г., 15:59:47 UTC+3 пользователь dan (ddpbsd) написал: On Thu, Feb 12, 2015 at 3:08 AM, alex petrov allrea...@gmail.com

Re: [ossec-list] check_diff

2015-02-13 Thread dan (ddp)
On Fri, Feb 13, 2015 at 8:26 AM, alex petrov allreadypa...@gmail.com wrote: I tested it, I need the files with changes. HOW TO Disable /var/ossec/queue/diff/*state.$epoch files? IN ossec 2.7 This function was enable/ Revert the patch. четверг, 12 февраля 2015 г., 15:59:47 UTC+3

Re: [ossec-list] Re: I cannot monitor my ASA 5520 by using OSSEC

2015-02-13 Thread Eero Volotinen
2015-02-13 17:43 GMT+02:00 Network Infrastructure panhatiger...@gmail.com: I don't see anything but I think I config my ASA working properly. Well, well. http://www.killyourdarlingsjournal.com/wp/wp-content/uploads/2014/06/5881861191_90de8b5bc9.jpg -- Eero -- --- You received this

Re: [ossec-list] Helo command rejected

2015-02-13 Thread George Ficzeri
On 2/12/15 1:44 PM, dan (ddp) wrote: On Thu, Feb 12, 2015 at 2:39 PM, dan (ddp) ddp...@gmail.com wrote: On Thu, Feb 12, 2015 at 2:19 PM, George Ficzeri geor...@onshore.com wrote: Hi, OSSEC is presenting itself as notify.ossec.net but this domain name does not resolve. Is there a

[ossec-list] Re: I cannot monitor my ASA 5520 by using OSSEC

2015-02-13 Thread Network Infrastructure
I don't see anything but I think I config my ASA working properly. Sir, can you show me how to config my ASA to send syslog to Ossec manager and also show me how to configure access list (ACL) On Friday, February 6, 2015 at 9:11:33 AM UTC+7, Network Infrastructure wrote: I have configured

Re: [ossec-list] Re: I cannot monitor my ASA 5520 by using OSSEC

2015-02-13 Thread dan (ddp)
On Fri, Feb 13, 2015 at 10:43 AM, Network Infrastructure panhatiger...@gmail.com wrote: I don't see anything but I think I config my ASA working properly. Did you verify that there were log messages created while running tcpdump? Maybe try running the tcpdump command on the manager and login to