I'm using 2.5.1. There is no separate manager; OSSEC runs on and reports
from this system.
On 06/17/2011 03:04 PM, dan (ddp) wrote:
Hi Steven,
Those are keepalive messages from an agent to the manager. You can ignore them.
What version of OSSEC do you have installed? They're supposed to be
ignored so they don't fire alerts...
On Fri, Jun 17, 2011 at 3:52 PM, Steven Stern
<subscribed-li...@sterndata.com> wrote:
What does this mean? Where do I look for an error?
Received From: ip-10-xxxxx->ossec-keepalive
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
--MARK--:
ggM6EJz3j+TNLDYHUgwX3-n_2esOyS6Eg0SLR(i1pjiiMpPOvufGY79ut]rR]FEc?-NRqd0GnqOhFMWioj.#y6OS1ndeS+ga#bRKfZy6^vv3pz@DJ8Xp-f7RttetiYtC0s$n*T)1%Wy.-RAzu=OYL4Ym=2F?uhC_zXPlk&#'HSExdne@SaE.4,XVYLdAS)p*KmKc.4JEq%18]5NN5*'(v/+BJ;2]tzv3LnoI(XucF+!%c6!q?3Qv1FeT#6,?Nr3')*^5-ep!HIS;i!WVHgyRLDerROr?oCGb1p6?7D9X@!.BOT=Ehp+aaHsSD=?R7FS&cs^!eT^^xul@$QXCnMC2Bco5'n4iar;c=8u]9d@axEtSC*_.@5ZV7v8j-Gr-Xk'.A1;d5lRK.!Lzd$xxME(o0cx/IO+OgwL_=*=e.-P[1I8mpNJ2*v&'xV;od$kYRdMI_(N*8Ku*(,/PJHl8lJ2-/USQ^2iA5cqc_lBfdV-D?C)-s/ZD-97_@uEcEM&S.aUz0+E3L9b;TC^@A-W4ZyT(a=_((4E^m;i#%];7m'Z5v-Ld#P8)v95v0bW[5[rAB%gj9/yDF=ciw]0cL&E6TRK
--
-- Steve
