Re: [ossec-list] Disable all rules for ossec server

[Huc Manté Miras]

Hi dan,
It's work,

Only include two files:

 
rules_config.xml
ossec_rules.xml
  


And change config to rules_config.xml to:





  
syslog
Generic template for all syslog rules.
  



  
ids
Generic template for all ids rules.
  



  
windows
Generic template for all windows rules.
  



  
ossec
Generic template for all ossec rules.
  





Restart ossec

Thanks for help!

El miércoles, 3 de mayo de 2017, 22:50:10 (UTC+2), dan (ddpbsd) escribió:
>
> On Tue, May 2, 2017 at 4:37 AM, Huc Manté Miras  > wrote: 
> > Only its needed to include two rule files: 
> > 
> > 
> >
> > rules_config.xml 
> > ossec_rules.xml 
> >
> > 
>
> Using just those 2 files allows OSSEC to start for me. 
> You can check the ossec.log for more information on why it failed. I'm 
> guessing something in local_rules.xml that relied on a rule that was 
> removed. 
>
> > 
> > 
> > El martes, 2 de mayo de 2017, 10:24:23 (UTC+2), Huc Manté Miras 
> escribió: 
> >> 
> >> Sorry man in the my last comment, i send the information. 
> >> 
> >> El miércoles, 26 de abril de 2017, 21:01:24 (UTC+2), dan (ddpbsd) 
> >> escribió: 
> >>> 
> >>> On Wed, Apr 26, 2017 at 5:42 AM, Huc Manté Miras  
> >>> wrote: 
> >>> > I try to remove all includes but not work :( 
> >>> > 
> >>> 
> >>> You provided me with no information to help correct the issue. 
> >>> 
> >>> > El martes, 25 de abril de 2017, 17:41:56 (UTC+2), dan (ddpbsd) 
> >>> > escribió: 
> >>> >> 
> >>> >> 
> >>> >> 
> >>> >> On Apr 25, 2017 11:25 AM, "Huc Manté Miras"  
> wrote: 
> >>> >> 
> >>> >> Hello, 
> >>> >> 
> >>> >> I try to disable all rules to ossec server. 
> >>> >> 
> >>> >> This is possible? 
> >>> >> 
> >>> >> 
> >>> >> Have you tried removing the rules from the server's ossec.conf? 
> >>> >> 
> >>> >> 
> >>> >> 
> >>> >> Thanks!! 
> >>> >> 
> >>> >> -- 
> >>> >> 
> >>> >> --- 
> >>> >> You received this message because you are subscribed to the Google 
> >>> >> Groups 
> >>> >> "ossec-list" group. 
> >>> >> To unsubscribe from this group and stop receiving emails from it, 
> send 
> >>> >> an 
> >>> >> email to ossec-list+...@googlegroups.com. 
> >>> >> For more options, visit https://groups.google.com/d/optout. 
> >>> >> 
> >>> >> 
> >>> > -- 
> >>> > 
> >>> > --- 
> >>> > You received this message because you are subscribed to the Google 
> >>> > Groups 
> >>> > "ossec-list" group. 
> >>> > To unsubscribe from this group and stop receiving emails from it, 
> send 
> >>> > an 
> >>> > email to ossec-list+...@googlegroups.com. 
> >>> > For more options, visit https://groups.google.com/d/optout. 
> > 
> > -- 
> > 
> > --- 
> > You received this message because you are subscribed to the Google 
> Groups 
> > "ossec-list" group. 
> > To unsubscribe from this group and stop receiving emails from it, send 
> an 
> > email to ossec-list+...@googlegroups.com . 
> > For more options, visit https://groups.google.com/d/optout. 
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [ossec-list] Disable all rules for ossec server

[dan (ddp)]

On Tue, May 2, 2017 at 4:37 AM, Huc Manté Miras  wrote:
> Only its needed to include two rule files:
>
>
>   
> rules_config.xml
> ossec_rules.xml
>   
>

Using just those 2 files allows OSSEC to start for me.
You can check the ossec.log for more information on why it failed. I'm
guessing something in local_rules.xml that relied on a rule that was
removed.

>
>
> El martes, 2 de mayo de 2017, 10:24:23 (UTC+2), Huc Manté Miras escribió:
>>
>> Sorry man in the my last comment, i send the information.
>>
>> El miércoles, 26 de abril de 2017, 21:01:24 (UTC+2), dan (ddpbsd)
>> escribió:
>>>
>>> On Wed, Apr 26, 2017 at 5:42 AM, Huc Manté Miras 
>>> wrote:
>>> > I try to remove all includes but not work :(
>>> >
>>>
>>> You provided me with no information to help correct the issue.
>>>
>>> > El martes, 25 de abril de 2017, 17:41:56 (UTC+2), dan (ddpbsd)
>>> > escribió:
>>> >>
>>> >>
>>> >>
>>> >> On Apr 25, 2017 11:25 AM, "Huc Manté Miras"  wrote:
>>> >>
>>> >> Hello,
>>> >>
>>> >> I try to disable all rules to ossec server.
>>> >>
>>> >> This is possible?
>>> >>
>>> >>
>>> >> Have you tried removing the rules from the server's ossec.conf?
>>> >>
>>> >>
>>> >>
>>> >> Thanks!!
>>> >>
>>> >> --
>>> >>
>>> >> ---
>>> >> You received this message because you are subscribed to the Google
>>> >> Groups
>>> >> "ossec-list" group.
>>> >> To unsubscribe from this group and stop receiving emails from it, send
>>> >> an
>>> >> email to ossec-list+...@googlegroups.com.
>>> >> For more options, visit https://groups.google.com/d/optout.
>>> >>
>>> >>
>>> > --
>>> >
>>> > ---
>>> > You received this message because you are subscribed to the Google
>>> > Groups
>>> > "ossec-list" group.
>>> > To unsubscribe from this group and stop receiving emails from it, send
>>> > an
>>> > email to ossec-list+...@googlegroups.com.
>>> > For more options, visit https://groups.google.com/d/optout.
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [ossec-list] Disable all rules for ossec server

[Huc Manté Miras]

Only its needed to include two rule files:


  
rules_config.xml
ossec_rules.xml
  


El martes, 2 de mayo de 2017, 10:24:23 (UTC+2), Huc Manté Miras escribió:
>
> Sorry man in the my last comment, i send the information.
>
> El miércoles, 26 de abril de 2017, 21:01:24 (UTC+2), dan (ddpbsd) escribió:
>>
>> On Wed, Apr 26, 2017 at 5:42 AM, Huc Manté Miras  
>> wrote: 
>> > I try to remove all includes but not work :( 
>> > 
>>
>> You provided me with no information to help correct the issue. 
>>
>> > El martes, 25 de abril de 2017, 17:41:56 (UTC+2), dan (ddpbsd) 
>> escribió: 
>> >> 
>> >> 
>> >> 
>> >> On Apr 25, 2017 11:25 AM, "Huc Manté Miras"  
>> wrote: 
>> >> 
>> >> Hello, 
>> >> 
>> >> I try to disable all rules to ossec server. 
>> >> 
>> >> This is possible? 
>> >> 
>> >> 
>> >> Have you tried removing the rules from the server's ossec.conf? 
>> >> 
>> >> 
>> >> 
>> >> Thanks!! 
>> >> 
>> >> -- 
>> >> 
>> >> --- 
>> >> You received this message because you are subscribed to the Google 
>> Groups 
>> >> "ossec-list" group. 
>> >> To unsubscribe from this group and stop receiving emails from it, send 
>> an 
>> >> email to ossec-list+...@googlegroups.com. 
>> >> For more options, visit https://groups.google.com/d/optout. 
>> >> 
>> >> 
>> > -- 
>> > 
>> > --- 
>> > You received this message because you are subscribed to the Google 
>> Groups 
>> > "ossec-list" group. 
>> > To unsubscribe from this group and stop receiving emails from it, send 
>> an 
>> > email to ossec-list+...@googlegroups.com. 
>> > For more options, visit https://groups.google.com/d/optout. 
>>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [ossec-list] Disable all rules for ossec server

[Jesus Linares]

I don't know if it is possible, but why do you want to do it?.

On Wednesday, April 26, 2017 at 11:42:22 AM UTC+2, Huc Manté Miras wrote:
>
> I try to remove all includes but not work :(
>
> El martes, 25 de abril de 2017, 17:41:56 (UTC+2), dan (ddpbsd) escribió:
>>
>>
>>
>> On Apr 25, 2017 11:25 AM, "Huc Manté Miras"  wrote:
>>
>> Hello,
>>
>> I try to disable all rules to ossec server.
>>
>> This is possible?
>>
>>
>> Have you tried removing the rules from the server's ossec.conf?
>>
>>
>>
>> Thanks!!
>>
>> -- 
>>
>> --- 
>> You received this message because you are subscribed to the Google Groups 
>> "ossec-list" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to ossec-list+...@googlegroups.com.
>> For more options, visit https://groups.google.com/d/optout.
>>
>>
>>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [ossec-list] Disable all rules for ossec server

[Huc Manté Miras]

I try to remove all includes but not work :(

El martes, 25 de abril de 2017, 17:41:56 (UTC+2), dan (ddpbsd) escribió:
>
>
>
> On Apr 25, 2017 11:25 AM, "Huc Manté Miras"  > wrote:
>
> Hello,
>
> I try to disable all rules to ossec server.
>
> This is possible?
>
>
> Have you tried removing the rules from the server's ossec.conf?
>
>
>
> Thanks!!
>
> -- 
>
> --- 
> You received this message because you are subscribed to the Google Groups 
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to ossec-list+...@googlegroups.com .
> For more options, visit https://groups.google.com/d/optout.
>
>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [ossec-list] Disable all rules for ossec server

[dan (ddp)]

On Apr 25, 2017 11:25 AM, "Huc Manté Miras"  wrote:

Hello,

I try to disable all rules to ossec server.

This is possible?


Have you tried removing the rules from the server's ossec.conf?



Thanks!!

-- 

---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[ossec-list] Disable all rules for ossec server

[Huc Manté Miras]

Hello,

I try to disable all rules to ossec server.

This is possible?

Thanks!!

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.