Hi Dan,
So this is what I have in my rule configuration on OSSEC server side.
<rule id="550" level="8">
<category>ossec</category>
<decoded_as>syscheck_integrity_changed</decoded_as>
<check_diff />
<options>alert_by_email</options>
<description>Integrity checksum changed.</description>
<group>syscheck,</group>
</rule>
But unfortunately , the alert didn't reported about output of differences
between old and new file.
Rule: 550 fired (level 8) -> "Integrity checksum changed."
Portion of the log(s):
Integrity checksum changed for: '/etc/php.ini'
Size changed from '69097' to '69098'
Old md5sum was: 'a82c6a40a5bbd7188c2cbd81d98e5faa'
New md5sum is : 'db8fb0e4a4e288c8e7ae24491599ed0c'
Old sha1sum was: 'b1c5e70e5974d6cad46db5b21136d86d4718a03f'
New sha1sum is : 'baa0c22e2e7d51f34b3bc02ad234af045a9def05'
Any help would be greatly appreciated.
Thanks
Srikanth
On Thursday, April 16, 2015 at 7:56:04 PM UTC-7, dan (ddpbsd) wrote:
>
>
> On Apr 16, 2015 10:54 PM, "srikanth kalangi" <srikant...@gmail.com
> <javascript:>> wrote:
> >
> > Hi Dan,
> >
> > Thank you very much for your reply.
> > Is it possible for you to provide the sample rule as I was unable to
> find it from
> http://dcid.me/2010/03/alerting-when-a-log-or-output-of-a-command-changes/
> which gets me 404 error.
> >
>
> What have you tried so far?
>
> > Thanks
> > Srikanth
> >
> >
> > On Thursday, April 16, 2015 at 11:20:56 AM UTC-7, dan (ddpbsd) wrote:
> >>
> >> On Thu, Apr 16, 2015 at 2:08 PM, srikanth kalangi
> >> <srikant...@gmail.com> wrote:
> >> > Hi Team,
> >> >
> >> > Is there a way to show the difference in the email alert like what
> has
> >> > changed between old & new file?
> >> >
> >> > Please help.
> >> >
> >> > It is showing the md5sum but the not the difference output.
> >> >
> >> >
> >> > Integrity checksum changed for: '/var/ossec/etc/ossec.conf'
> >> >
> >> > Size changed from '2777' to '2817'
> >> >
> >> > Old md5sum was: 'a69f4ab990235e4eeb61b5d2d839dcc8'
> >> >
> >> > New md5sum is : '72ce6db1b1983a4a07de78abfdf0724e'
> >> >
> >> > Old sha1sum was: 'c9f86b33392f7f2e87ac5e1e38344c0bd1be5cb9'
> >> >
> >> > New sha1sum is : '8fe3613d520900260e1c3fceada8fdad8e2b00bb'
> >> >
> >>
> >> The check_diff rule option can help with that:
> >>
> http://ossec-docs.readthedocs.org/en/latest/syntax/head_rules.html?highlight=check_diff#element-check_diff
>
> >>
> >> >
> >> >
> >> > Thanks
> >> >
> >> > Srikanth
> >> >
> >> > --
> >> >
> >> > ---
> >> > You received this message because you are subscribed to the Google
> Groups
> >> > "ossec-list" group.
> >> > To unsubscribe from this group and stop receiving emails from it,
> send an
> >> > email to ossec-list+...@googlegroups.com.
> >> > For more options, visit https://groups.google.com/d/optout.
> >
> > --
> >
> > ---
> > You received this message because you are subscribed to the Google
> Groups "ossec-list" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an email to ossec-list+...@googlegroups.com <javascript:>.
> > For more options, visit https://groups.google.com/d/optout.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
