I'm confused. I have a working agentless setup for my 1 test node, but I am not seeing any data in logs/alerts/alerts.log indicating that an alert was triggered when I modify files that are being integrity checked.
The stanza in the manager's ossec.conf (then I restarted ossec of course): <agentless> <type>ssh_integrity_check_linux</type> <frequency>30</frequency> <host>use_sudo admin@agentless-test-rh6</host> <state>periodic</state> <arguments>/var/www</arguments> </agentless> On the remote host, I change the contents of a monitored file: [root@agentless-test-rh6 log]# echo eoweho34rt34 > /var/www/html/new.txt [root@agentless-test-rh6 log]# I see agentlessd do its thing as reported in logs/ossec.log: 2015/02/23 15:50:18 ossec-agentlessd: INFO: ssh_integrity_check_linux: admin@agentless-test-rh6: Login seems okay 2015/02/23 15:50:18 ossec-agentlessd: INFO: ssh_integrity_check_linux: admin@agentless-test-rh6: use_sudo specified and 'sudo sh;' worked. 2015/02/23 15:50:18 ossec-agentlessd: INFO: ssh_integrity_check_linux: admin@agentless-test-rh6: Arguments: /var/www 2015/02/23 15:50:18 ossec-agentlessd: INFO: ssh_integrity_check_linux: admin@agentless-test-rh6: Starting. 2015/02/23 15:50:18 ossec-agentlessd: INFO: ssh_integrity_check_linux: admin@agentless-test-rh6: Finished. Yet: root@ossec:/var/ossec/logs# grep agentless-test-rh6 alerts/alerts.log root@ossec:/var/ossec/logs# If I change the contents of the monitored file again and run ssh_integrity_check_linux by hand, I see this and can confirm the hash being reported here has in fact changed and that the script is doing its work: root@ossec:/var/ossec# sudo -u ossec agentless/ssh_integrity_check_linux use_sudo admin@agentless-test-rh6 /var/www ... FWD: 18:600:0:0:2b7c78d8e06d2bf9c141140d08def55b:172e523b4603eecd3d18aa1d68bd4811077339fb /var/www/html/new.txt FWD: 584:600:0:0:ab8c863437db6318a3b5a9f98a0dac76:91b00d2b0f00dea53daf063e500df2bb4c1050d7 /var/www/html/index.html ... Any thoughts on why there's no alert recorded? I have no trouble getting hash change alerts from hosts that are running the agents. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.