I don't know if this is a known problem, but anyway... It seems that there is an error in the ossec web ui. More exacly the databese dump for an agent will be empty, if the agent name is something like hostname.domain.tld (it works ok if the agent name does not contains dots). After some investigation i have found that the problem is in [ossec- wui]/lib/os_lib_syscheck.php in the function os_syscheck_dumpdb($ossec_handle, $agent_name). The preg_match pattern specified around line 265 will not match agent names with dots in their name. For a workaround i have changed the first part of the preg pattern to: $filepattern = "/^\(([\S]+)\) "."[0-9\._]+->([a-zA-Z_-]+)$/"; - of course, i am not a PCRE guru. And now it will match even those agent names which have dots in their name.
Thanks for this great software! Regards, M. Sanyi
