I'm collected firewall logs from many Ubuntu servers (basically the /var/log/ufw.log). In this log, I can see events about TCP, UDP and ICMP traffic (allowed or dropped). But, on my OSSEC server, in my firewall.log, I don't see any event related to the ICMP protocol...
/x On Sat, Jan 23, 2016 at 11:45 PM, Santiago Bassett < santiago.bass...@gmail.com> wrote: > I am afraid I don't understand the problem or question, maybe if you > explain it a little bit more we can help better. > > Best > > On Thu, Jan 21, 2016 at 7:56 AM, Xavier Mertens <xmert...@gmail.com> > wrote: > >> Hi *, >> >> Maybe a stupid question but I'm investigating an issue and I've to browse >> my history of firewall.log files. Problem: I find only TCP/UDP events and >> nothing regarding ICMP packets? >> >> I tested via ossec-logstest and events are correctly parsed... >> >> I never paid attention to this in the past... :-( >> Any idea? >> >> /x >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to ossec-list+unsubscr...@googlegroups.com. >> For more options, visit https://groups.google.com/d/optout. >> > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
