On Sun, Apr 7, 2013 at 8:44 PM, Erkki Saikkonen <[email protected]> wrote: > Hi, > > New to using Ossec, need help with use and alerts. Why doesnt OSSEC agents > generate alerts if you remove directory or file listed in syscheckd
Agents never generate alerts, only servers (and local installs) generate alerts. > configuration in ossec.conf? Other thing is that OSSEC doesnt report changes You should get alerts for this. Check for rule 553 in alerts.log. Also, check for the file in the agent's syscheck db in /var/ossec/queue/syscheck. > of ownership or rights for directories at all. Only for files changes are > alerted. > > I get a WARN in agents own ossec.log, but no alert to server alerts.log. Am > I missing something here? > > Example piece of my configuration: > <directories check_all="yes">%WINDIR%/important/important.txt</directories> > or > <directories check_all="yes">%WINDIR%/important</directories> > > Any help much appreciated! > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
