Re: [ossec-list] Wazuh install and mysql

Hi Sean, What rpm are you using? wazuh-manager-1.1.1-3 or ossec-hids-2.8.3-3? Regards --- Jose Luis Ruiz Wazuh Inc. j...@wazuh.com On December 12, 2016 at 5:25:41 PM, Sean Roe (sean...@gmail.com) wrote: Hi all, I have installed the ossec server using the Wazuh rpms and it i

Re: [ossec-list] Does Ossec support MariaDB?

Hi, There hasn't been any action on this topic for over a year but it was never answered and I'm running into the same issue. What libraries is it looking for? Is there somewhere that I can look at, possibly edit the list? Why does it look for particular libraries, couldn't I just specify th

[ossec-list] Re: regex in agent id field

Thanks, I think I will be using the profiles option. Sean On Friday, December 9, 2016 at 2:56:19 AM UTC-7, Jesus Linares wrote: > > Hi Sean, > > it seems that agent_config name > is > checked by the function OS_Match2 >

[ossec-list] Wazuh install and mysql

Hi all, I have installed the ossec server using the Wazuh rpms and it is running well. I have 20 servers sending data too it and they are working great. I would like to write the data out to a mysql database and was wondering what the right procedure would be. Do I uninstall the rpm first the

[ossec-list] Non standard use case

I have about 30 hosts that I cannot install the OSSEC agent directly on. This is due to dependencies on old turn key servers. Many of these servers don't have make, gcc on them and I can't put them on there (or maybe I just don't have the know how to get them on without breaking anything). I'

Re: [ossec-list] remoted Dropping Events

Victor, Thanks. What I was doing was *rm*ing everything in /var/ossec except for queue and logs. Then I was installing the newly-compiled code. When the installer asked if I wanted to update, I answered "yes", which apparently defaults the installation to a local installation (I'm not sure t

Re: [ossec-list] remoted Dropping Events

Hi Chris, since you compiled the project with "TARGET=server", maybe you chose "local" when installed it. A local installation is a profile like a server but without Remoted, that's why that daemon doesn't start with "ossec-control start". The line at ossec-init.conf has only informational pur

Re: [ossec-list] remoted Dropping Events

Victor, ossec-init.conf is showing the the installation is a *local* installation. However, I know that I performed a server installation per my notes and bash history… make clean make TARGET=server Obviously I could change this value back to 'server', but will this fix the issue? Thank