On Thu, Mar 28, 2013 at 2:13 AM, SSaid <[email protected]> wrote: > Hello there! > > I've installed OSSEC 2.7 on a Solaris 10 server, and configured an agent on > a Windows server. The Windows server is acting as a log-collector for > several other nodes. I've configured the agent.conf file to include the > Forwarded Events log, as well as Security,System, and Application logs.
How did you do this? I don't think agent profiles are working on Windows, so you would need to use one of the other methods. > The OSSEC server and agent have started just fine, and the agent ossec.log > file shows that the logs are being analyzed, but I do not receive any alerts > other than the OSSEC server and agent starting. > There are no other alerts in alerts.log? > I've tried invoking some events to generate alerts but receive nothing (e.g. > I configured the rules for failed logins to be level 8 and performed > several consecutive failed logins but nothing happened). > Turn on the log all option, and provide log samples as well as rule changes you've made. > Ossec is set to log alerts of level 1 and alert by email for level 7. > > I've gone through the server and agent configurations and rules multiple > times and can't seem to find the problem. > > Any help would be greatly appreciated, I've been hitting dead ends for a > week now! =\ > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
