On Tue, Aug 12, 2014 at 9:40 AM, Andreas Fantides <[email protected]> wrote: > Hi Dan, > > I have moved all of Ossec to the /var/ossec directory and confirmed that > everything is started, working and reporting, but am still having no luck > with agentless. > > I have tried your command and received the output in the attachment. Any > ideas? >
Try `expect agentless/ssh_generic_diff HOST` or something like that. I thinkn that's what you wanted to run. > Many thanks > Andreas > > > On Tuesday, 12 August 2014 13:33:42 UTC+1, Andreas Fantides wrote: >> >> Cheers Dan, I think you might be on to something here, I'll test and >> report back.... >> >> On Tuesday, 12 August 2014 12:11:27 UTC+1, dan (ddpbsd) wrote: >>> >>> On Tue, Aug 12, 2014 at 6:54 AM, Andreas Fantides >>> <[email protected]> wrote: >>> > Hi Dan, and thanks for the information. How do I run manually though? >>> > >>> >>> `cd /var/ossec && expect agentless/script` >>> >>> I think it expects to be run from /var/ossec. >>> >>> > I have attached my expect script and can't see anything wrong, but was >>> > wondering if anyone could take a look? >>> > >>> > Cheers. >>> > >>> > >>> > On Monday, 11 August 2014 17:49:28 UTC+1, dan (ddpbsd) wrote: >>> >> >>> >> On Sun, Aug 10, 2014 at 9:20 AM, Andreas Fantides >>> >> <[email protected]> wrote: >>> >> > I've been really struggling to get agentless monitoring set up and >>> >> > working >>> >> > with HP Procurve 2524 switches. >>> >> > >>> >> > I have done the following: >>> >> > >>> >> > · Enabled agentless on the Ossec server. >>> >> > >>> >> > · Registered the switch using a password like this >>> >> > [email protected] Password (I am assuming that you place the >>> >> > user/login >>> >> > name to ssh into the switch before the @, and the password is the >>> >> > ssh >>> >> > password) >>> >> > >>> >> > · Set Ossec config for ssh_generic_diff, with >>> >> > [email protected] as >>> >> > the host, argument is show config >>> >> > >>> >> > · I have enabled logging to my server on the switch >>> >> > >>> >> > · Added my server as an ip-authorised manager on the switch >>> >> > >>> >> > · Enabled ssh on the switch (can PuTTy in) >>> >> > >>> >> > Yet after all this agentless doesn't want to work and in the >>> >> > ossec.log >>> >> > it >>> >> > says test passed for ssh_generic_diff, but then shows that agentless >>> >> > times >>> >> > out and wont connect to the switch. >>> >> > >>> >> > Can anyone help? >>> >> > >>> >> >>> >> Try running it manually. I'm guessing the login doesn't quite look the >>> >> way "expect" expects. >>> >> I don't know a whole lot about it, but I think the list could help to >>> >> get it working. Knowing what the SSH login looks like, and what >>> >> commands you need run would help. >>> >> >>> >> > -- >>> >> > >>> >> > --- >>> >> > You received this message because you are subscribed to the Google >>> >> > Groups >>> >> > "ossec-list" group. >>> >> > To unsubscribe from this group and stop receiving emails from it, >>> >> > send >>> >> > an >>> >> > email to [email protected]. >>> >> > For more options, visit https://groups.google.com/d/optout. >>> > >>> > -- >>> > >>> > --- >>> > You received this message because you are subscribed to the Google >>> > Groups >>> > "ossec-list" group. >>> > To unsubscribe from this group and stop receiving emails from it, send >>> > an >>> > email to [email protected]. >>> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
