[ossec-list] inotify syscheck - question and possible bug

2011-07-19 Thread Marcelo de Miranda Barbosa
Hello dcid, I think that I found a bug. I am using OSSEC 2.6 in two linux servers, a server and a agent... with Debian squeeze. My question or possible bug is with inotify and syscheck. When I change more that tree times a file that are monitored with realtime (inotify) the fourth time does not

Re: [ossec-list] Did not receive identification string from UNKNOWN

2011-07-19 Thread dan (ddp)
For some reason OpenSSH is giving you that: canohost.c: /* Get the real hostname if socket; otherwise return UNKNOWN. */ canohost.c: host = "UNKNOWN"; On Mon, Jul 11, 2011 at 5:49 PM, j5-hms wrote: > Hi, > > I have a agent/server OSSEC setup and everything is going well.  I'm > i

Re: [ossec-list] OSSEC v2.6 released

2011-07-19 Thread Jason Frisvold
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 19, 2011, at 3:31 PM, Daniel Cid wrote: > Hi lists, > > We are very happy to announce the availability of OSSEC version 2.6. > > This has been a long release cycle, but it is here now with some good > new features and very stable (thanks to ou

[ossec-list] How do I kill a ghost OSSEC agent host?

2011-07-19 Thread blacklight
Hello Folks, I am trying to get a host that I had removed from OSSEC monitoring through /var/ossec/bin/manage-agents completely off the list of hosts in the OSSEC GUI - The host name still remains on the OSSEC GUI but it's a ghost (or if you prefer, a zombie) - How do I wipe this ghost out?

Re: [ossec-list] OSSEC v2.6 released

2011-07-19 Thread Jason 'XenoPhage' Frisvold
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 19, 2011, at 3:31 PM, Daniel Cid wrote: > Hi lists, > > We are very happy to announce the availability of OSSEC version 2.6. > > This has been a long release cycle, but it is here now with some good > new features and very stable (thanks to ou

Re: [ossec-list] OSSEC v2.6 released

2011-07-19 Thread Darvin Denmian
Is the upgrade process from 2.4 to 2.6 easy? On Tue, Jul 19, 2011 at 4:31 PM, Daniel Cid wrote: > Hi lists, > > We are very happy to announce the availability of OSSEC version 2.6. > > This has been a long release cycle, but it is here now with some good > new features and very stable (thanks t

[ossec-list] OSSEC v2.6 released

2011-07-19 Thread Daniel Cid
Hi lists, We are very happy to announce the availability of OSSEC version 2.6. This has been a long release cycle, but it is here now with some good new features and very stable (thanks to our beta users). Our manual for the new version is also live at http://www.ossec.net/doc/ . Release notes +

Re: [ossec-list] Get Logfiles from PSQL / MySQL

2011-07-19 Thread Kelly Fitzgerald
it could be possible to write a script to do exports to plain text from the db to ossec, index the files in ossec them remove then on a crontab or some other scheduler... at least this is what i woudl try. On Tue, Jul 19, 2011 at 8:33 AM, dan (ddp) wrote: > There's no real support for this. OSSEC

Re: [ossec-list] Get Logfiles from PSQL / MySQL

2011-07-19 Thread dan (ddp)
There's no real support for this. OSSEC is designed to work with plain text logfiles and windows event logs. On Tue, Jul 19, 2011 at 3:03 AM, Tobias Dinse wrote: > Hi all, > > I m actually testing OSSEC on our virtual test maschine. I have a running > rsyslog (Logs stored in Postgresql DB) with L

[ossec-list] Get Logfiles from PSQL / MySQL

2011-07-19 Thread Tobias Dinse
Hi all, I m actually testing OSSEC on our virtual test maschine. I have a running rsyslog (Logs stored in Postgresql DB) with Logfiles from other Servers, too. Is it possible to configure ossec to check the Log entrys from the psql-Database? Thanks in advance Tobias