Re:RE: [ossec-list] No server respone

2013-10-15 Thread
Hi, Looking the ossec.log (Path:/var/ossec/logs/ossec.log) Wean. -- Original -- From: "pranav.lal";; Date: Wed, Oct 16, 2013 08:43 AM To: "ossec-list"; Subject: RE: [ossec-list] No server respone Hi, https://groups.google.com/groups/opt_out. -- --- Yo

Re: [ossec-list] Multiple email addresses for a single email_alert

2013-10-15 Thread
Hi, where can I config the EMAIL? I only find those in the ossec.conf yes wean...@gmail.com alt3.gmail-smtp-in.l.google.com. ossecm@. 1 5 It didn't send email to me . :( -- Original -- From: "Ryan Schulze";; Date:

[ossec-list] Display src_ip as hostname

2013-10-15 Thread Jeff Allison
Is there anyway to display the src_ip field as a hostname in the reports generated by ossec-reportd. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-

RE: [ossec-list] No server respone

2013-10-15 Thread Pranav Lal
Hi, https://groups.google.com/groups/opt_out.

Re: [ossec-list] Ossec Syscheck don't check integrity

2013-10-15 Thread dan (ddp)
On Tue, Oct 15, 2013 at 2:10 PM, Cristiano Galdino wrote: > Hi! > > I installed the default OSSEC SERVER 2.7.1-beta-1 on Debian 7. > > This is my /var/ossec/etc/ossec.conf: > > [...] > > > 300 > yes > > > /etc,/usr/bin,/usr/sbin > /bin,/sbin > check_all="yes">/root/

[ossec-list] Ossec Syscheck don't check integrity

2013-10-15 Thread Cristiano Galdino
Hi! I installed the default OSSEC SERVER 2.7.1-beta-1 on Debian 7. This is my */var/ossec/etc/ossec.conf*: [...] *300* yes /etc,/usr/bin,/usr/sbin /bin,/sbin /root/integrity [...] [...] My */etc/crontab*: [...] */1 * * * * root/script.sh [...] And

RE: [ossec-list] missing something

2013-10-15 Thread Rhoads, Robert W.
Dan, Thank you! It does appear to be an issue with the email server and not anything under my care. -Original Message- From: ossec-list@googlegroups.com [mailto:ossec-list@googlegroups.com] On Behalf Of Rhoads, Robert W. Sent: Tuesday, October 15, 2013 9:59 AM To: ossec-list@googlegro

RE: [ossec-list] missing something

2013-10-15 Thread Rhoads, Robert W.
Yes ossec-maild is running: ossecm 846 1 0 08:08 ?00:00:10 /var/ossec/bin/ossec-maild I did get one email alert, in the last hour from one of the agents, but what is odd is that with some gaps here and there it is usually a bit of a torrent. Overnight I should have gotten about 1

[ossec-list] Re: Empty "Src Location: " in alert using GeoIP while srcip is found

2013-10-15 Thread Bernard
Yes I did, except for the compiling. The compiled version of OSSEC from the repository came with "maild.geoip=1" by default. I configured ossec.conf the way you showed below and ossec.log does not complain about the added XML-tags. So I assume OSSEC understands the tags and it does show the 'Sr

Re: [ossec-list] missing something

2013-10-15 Thread dan (ddp)
On Tue, Oct 15, 2013 at 9:43 AM, Rhoads, Robert W. wrote: > Hello, > > > > I am running OSSEC 2.7 and have been doing so successfully for a while > now, but overnight something happened and I’m missing something to “fix” it. > I am no longer getting email for events from the OSSEC server. No

[ossec-list] missing something

2013-10-15 Thread Rhoads, Robert W.
Hello, I am running OSSEC 2.7 and have been doing so successfully for a while now, but overnight something happened and I'm missing something to "fix" it. I am no longer getting email for events from the OSSEC server. Nothing has changed on the Windows agents or the Ossec server. I have

Re: [ossec-list] No server respone

2013-10-15 Thread Eli
Thanks. That did the trick. What about the "Unable to start OSSEC (check config)" error? How do I get rid of that? On Tuesday, 15 October 2013 16:02:14 UTC+3, Pranav Lal wrote: > > Hi, > There is an error in the key that you are entering into the agent. I > had this happen to me the first t

Re: [ossec-list] No server respone

2013-10-15 Thread Pranav Lal
Hi, There is an error in the key that you are entering into the agent. I had this happen to me the first time I ran ossec (2 weeks ago). Look for characters like hard returns. I was lucky, that I spotted them correctly. Pranav On 10/15/13, Eli wrote: > ossec.log says: > ERROR: Incorrectly format

Re: [ossec-list] No server respone

2013-10-15 Thread Eli
ossec.log says: ERROR: Incorrectly formatted message from '4.4.4.3' (my agent ip) Guess I should have looked here earlier. How do I fix this? Thanks On Tuesday, 15 October 2013 13:27:02 UTC+3, Pranav Lal wrote: > > Hi Eli, > > What do the logs on the agent and those on the server show? > > P

Re: [ossec-list] No server respone

2013-10-15 Thread Pranav Lal
Hi Eli, What do the logs on the agent and those on the server show? Pranav On 10/15/13, Eli wrote: > I have installed ossec server on linux mint & client on win7. > After adding client and extracting key I started the windows client. > The client is now transmitting tto udp port 1514, however f

Re: [ossec-list] Client.keys

2013-10-15 Thread koby yakov
Hi Chris, i'm facing with the same issue that you were having here, my current status is: i'm abling to install the agents on the windows machine, copy the conf file and create the agents on the server side. i need your assistence with extracting the keys from the server side and insert e

[ossec-list] No server respone

2013-10-15 Thread Eli
I have installed ossec server on linux mint & client on win7. After adding client and extracting key I started the windows client. The client is now transmitting tto udp port 1514, however for some reason the server is not replying. The network connection is OK and pinging between machines works