[ossec-list] RE: agent-auth (4000 limit)

2012-04-02 Thread Swartz, Patrick H
Hi, modifying the src/addagent/validate.c file -- { i = 1024; snprintf(nid, 6, "%d", i); while(IDExist(nid)) { i++; snprintf(nid, 6, "%d", i); if(i >= 9000) { return(NULL); } }

[ossec-list] agent-auth (4000 limit)

2012-04-02 Thread Tate Hansen
Hi: I just ran into this issue over the weekend - did you find a solution? On 2/14/12 9:54 AM, "Swartz, Patrick H" wrote: >Hi Dan, >Yes we use the -D option. I have reason to believe that we are hitting a >hard-coded limit of 4000 in the addagent/validate.c file. Our current >client.keys file

Re: [ossec-list] Large installs.

2012-04-02 Thread Phil Cox
So here is my plan for a global cloud arch (systems very volitile) - "Local" install - Alert via Syslog to central server on dedicated "facility" - Local Syslog go to central server - Central console (Graylog2?) parsing all syslog for custom correlation Should scale to 10's of thousands. We'll se

Re: [ossec-list] Problems using multiple sid in a custom rule

2012-04-02 Thread dan (ddp)
/var/ossec/bin/logtest -t Try troubleshooting the issue. On Apr 2, 2012 6:31 AM, "C. L. Martinez" wrote: > Hi all, > > I have an strange problem. I have defined a custom rule to trigger an > alert when a RBN IP comes as a srcip in my logs file. For example: > > > >100202,100203,100201 >

[ossec-list] Re: Problems using multiple sid in a custom rule

2012-04-02 Thread C. L. Martinez
On Mon, Apr 2, 2012 at 9:56 AM, C. L. Martinez wrote: > Hi all, > >  I have an strange problem. I have defined a custom rule to trigger an > alert when a RBN IP comes as a srcip in my logs file. For example: > > >   >    100202,100203,100201 >    108.60.159.33 >    Connection from RBN IP >   > >

Re: [ossec-list] ossec-analysisd: ERROR: Compiled rule not found: if_bad_useragent

2012-04-02 Thread Stephane
hi, Thanks for the quick answer. This is the content of my compiled_rules.h: /* This file is auto generated by ./register_rule.sh. Do not touch it. */ /* Adding the function definitions. */ void *check_id_size(Eventinfo *lf); void *comp_mswin_targetuser_calleruser_diff(Eventinfo *lf); void *comp

Re: [ossec-list] ossec-analysisd: ERROR: Compiled rule not found: if_bad_useragent

2012-04-02 Thread Daniel Cid
Can you take a look at the file src/analysisd/compiled_rules/compiled_rules.h to see if your new function is there? Also, did you re-run make and copied the new analysisd binary to /var/ossec/bin? *Btw, your current function is actually slower than using the from OSSEC. It is doing a open+read+r

[ossec-list] ossec-analysisd: ERROR: Compiled rule not found: if_bad_useragent

2012-04-02 Thread Stephane
Hi all, I need a rule for Apache to check if a "bad useragent" like Nikto, Zeus, WebReaper etc is crawling a webserver. Additionally I need a file where all my forbidden useragents are listed. My first thought was to use the tag in a rule like this: 31100 rules/bad_useragents AP

Re: [ossec-list] Optimization Help for MySQL Database Containing OSSEC Alerts

2012-04-02 Thread Doug Burks
Hi Chris, You mention logstash and Splunk, but have you looked at ELSA? http://code.google.com/p/enterprise-log-search-and-archive/ Regards, Doug On Sun, Apr 1, 2012 at 8:45 PM, Decker Christopher wrote: > All, > > I'm running MySQL + Apache/PHP on a very beefy box but using the out-of-box > OS

[ossec-list] Problems using multiple sid in a custom rule

2012-04-02 Thread C. L. Martinez
Hi all, I have an strange problem. I have defined a custom rule to trigger an alert when a RBN IP comes as a srcip in my logs file. For example: 100202,100203,100201 108.60.159.33 Connection from RBN IP When I try to load these type of rules, this error occurred: 2012/04/