Hi, I have a strange problem which I can't solve. OSSEC v8.2.3 is working fine, active respone for apache, ssh and other services is working without problems.
IPtables logs are written to a file calles iptables.log using rsyslogd. Analyzing the file using the ossec-logtest works and shows the correct decoding, piping this to the ossec-reportd shows that everything is finde and scans / drops are detected and the correct rules are matched. Turning on the debug mode in ossec also shows that the log is analyzed. However: firewall.log stays empty (option is set to 1) and there are no alerts for drops in iptables.log (I removed the no_log option from the rule). Also if I do a nmap scan nothing happens. any ideas? thanks Kai -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
