[ossec-list] Parsing json log files

2013-10-25 Thread carlopmart
Hi all, How can I parse json log format with ossec?? According to docs, the more close logformat supported by ossec is multiline, but I don't see how can I configure this ... -- CL Martinez carlopmart {at} gmail {d0t} com -- --- You received this message because you are subscribed t

Re: [ossec-list] Release date for OSSEC 2.7.1

2013-10-24 Thread carlopmart
ease date scheduled. We were getting ready to > release but then discovered a couple of issues that we would like to > address first. The most recent beta is pretty stable, though, and will > be pretty close to what is in 2.7.1. > many thanks Michael -- CL Martinez carlopmart {at} gma

Re: [ossec-list] Disable rule when certain decoder is used

2012-09-11 Thread carlopmart
list, alert is triggered, but if rule 1002 is triggered before, it is a problem ... For this reason, I need to disable rule 1002 for this decoder/rules associated with logs received from this fw, because rule 1002 always will be a false possitive ... -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Disable rule when certain decoder is used

2012-09-08 Thread carlopmart
can see, rule 1002 is triggered because "bad" word appears in this log ... but this is not a "Unknown problem somewhere in the system.". It is a false possitive. Is it possible to disable rule 1002 only for this case??. For example, whem my cutom-openbsd-pf decoder is used, disable rule 1002 ... Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Multiple groups in syslog output

2012-09-08 Thread carlopmart
On 09/08/2012 02:24 AM, JB wrote: There may be an option (c), using regular expression: aa|bb|cc Good. Previous, configurations exposed doesn't works. I will try this. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Errors with telnet.exe binary under Windows 2008 R2

2012-08-26 Thread carlopmart
On 08/26/2012 01:10 AM, Michael D. Wood wrote: I had the same problem and compared the backslash forward slash to a known working system. I had to actually delete the agent file from the /var/ossec/rids directory (don't quote me on the directory, I'm on my phone, can't check for accuracy) . Resta

[ossec-list] Some problems in HA environment using latest version

2012-08-26 Thread carlopmart
yes This approach it could be usefull to sync for example, local_decoder.xml or rules. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Errors with telnet.exe binary under Windows 2008 R2

2012-08-25 Thread carlopmart
On 08/25/2012 10:27 PM, carlopmart wrote: On 08/25/2012 10:18 PM, Michael Starks wrote: On 08/25/2012 02:17 PM, Ryan Schulze wrote: forward slash, backslash problem ? 'C:\Windows/System32/telnet.exe' != 'C:\Windows\System32\telnet.exe' 'C:\Windows/System32/tel

Re: [ossec-list] Errors with telnet.exe binary under Windows 2008 R2

2012-08-25 Thread carlopmart
is a problem with the MAC label not allowing ossec access to the file. MAC label?? Uhmm, maybe you are right ...What permissions do I need to setup in this binary?? At this moment SYSTEM, Administrators and Users use Read & Execute ... Only TrustedInstaller have full control ... -- CL M

Re: [ossec-list] Errors with telnet.exe binary under Windows 2008 R2

2012-08-25 Thread carlopmart
ws/System32/tftp.exe'. 2012/08/25 17:46:01 ossec-agent: INFO: Monitoring directory: 'C:\Windows/System32/drivers/etc'. 2012/08/25 17:46:01 ossec-agent: INFO: Monitoring directory: 'C:\Documents and Settings/All Users/Start Menu/Programs/Startup' -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Errors with telnet.exe binary under Windows 2008 R2

2012-08-25 Thread carlopmart
79,872 telnet.exe 1 File(s) 79,872 bytes 0 Dir(s) 149,738,332,160 bytes free C:\Windows\System32> Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Reading tcpdump binary files in ossec agent

2012-07-07 Thread carlopmart
Hi all, Is it possible to configure a command on an ossec agent to read a tcpdump binary file?? For example: command tcpdump -nv -ttt -r /var/log/pflog Could this be work?? -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Re: What does this error means??

2012-07-07 Thread carlopmart
On 07/07/2012 04:31 PM, carlopmart wrote: After updating my ossec server to a latest release in bitbucket, I see this error on manager side: ossec-logcollector(2301): ERROR: Definition not found for: 'logcollector.remote_commands'. What does it means?? Ok, it seems a new op

[ossec-list] What does this error means??

2012-07-07 Thread carlopmart
After updating my ossec server to a latest release in bitbucket, I see this error on manager side: ossec-logcollector(2301): ERROR: Definition not found for: 'logcollector.remote_commands'. What does it means?? -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Decoding CEF log formats

2012-05-05 Thread carlopmart
On 05/05/2012 09:13 PM, dan (ddp) wrote: \p? Otherwise, provide a sample please. On May 4, 2012 4:18 PM, "carlopmart" mailto:carlopm...@gmail.com>> wrote: Hi all, I am trying to write a new decoder to process CEF log formats, but I have a problems to escape

[ossec-list] Re: Decoding CEF log formats

2012-05-05 Thread carlopmart
On 05/04/2012 10:01 PM, carlopmart wrote: Hi all, I am trying to write a new decoder to process CEF log formats, but I have a problems to escape '|'. For example: ^\d\|\d+\| doesn't works ... How can I escape '|' special character?? Thanks. Please, any idea?? -- C

Re: [ossec-list] Ossec server doesn't sent mails when alerts are triggered

2012-05-05 Thread carlopmart
cond is reached, ossec loose a lot of events). May be these problems can be solved in next ossec release: using a real MTA like postfix or qmail instead of ossec-maild, and modifiying ossec-remoted when is used to receive alot of syslog messages using rsyslog or syslog-ng todo this task ...

[ossec-list] Decoding CEF log formats

2012-05-04 Thread carlopmart
Hi all, I am trying to write a new decoder to process CEF log formats, but I have a problems to escape '|'. For example: ^\d\|\d+\| doesn't works ... How can I escape '|' special character?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Problem with ossec's syslog options and ossec-remoted process

2012-05-01 Thread carlopmart
On 05/01/2012 02:14 AM, dan (ddp) wrote: On Apr 30, 2012 4:11 PM, "carlopmart" mailto:carlopm...@gmail.com>> wrote: > > Hi all, > > I have several problems with ossec-remoted process and ossec's syslog remote options. My ossec server is configured to rec

[ossec-list] Problem with ossec's syslog options and ossec-remoted process

2012-04-30 Thread carlopmart
ction environments?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Default checkpoint decoder provided by ossec doesn't works

2012-04-30 Thread carlopmart
checkpoint decoder makes this work. In fact, changing the decoder to this made it work with one of your examples and one of the examples in the decoder.conf: ^Checkpoint ^\s*\S+ \d\d:\d\d:\d\d On Mon, Apr 30, 2012 at 4:31 AM, carlopmart wrote: Hi all, I am doing some tests sending

[ossec-list] Sample about generating a weekly report

2012-04-30 Thread carlopmart
Hi all, Somebody have a sample script to generate a weekly report? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Default checkpoint decoder provided by ossec doesn't works

2012-04-30 Thread carlopmart
t: 30Apr2012 9:52:24 accept 172.23.4.3 >Lan2 rule: 54; rule_uid: {9FF8FDBD-D83B-4AF2-AA55-29E72F37DEC2}; service_id: https; src: 192.168.74.18; dst: 10.200.101.207; proto: tcp; product: VPN-1 & FireWall-1; service: 443; s_port: ;' **Phase 2: Completed decoding. No decoder matched. Where is the problem?? -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Problems installing under CentOS5

2012-04-21 Thread carlopmart
[root@shadowfax ossec-hids-2.6]# yum install binutils Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Setting up Install Process Package binutils-2.17.50.0.6-20.el5.i386 already installed and latest version Nothing to do Where is the problem?? -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] How to reload local_rules.xml, local_decoder.xml and ossec.conf?

2012-04-16 Thread carlopmart
On 04/16/2012 07:32 PM, dan (ddp) wrote: No, a restart is required On Apr 16, 2012 1:13 PM, "carlopmart" mailto:carlopm...@gmail.com>> wrote: Hi all, Somebody knows how can these files be reloaded without stopping server processes?? Something like "kill -

[ossec-list] How to reload local_rules.xml, local_decoder.xml and ossec.conf?

2012-04-16 Thread carlopmart
Hi all, Somebody knows how can these files be reloaded without stopping server processes?? Something like "kill -HUP ossec_service.pid"?? -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Question about freebsd agents

2012-04-14 Thread carlopmart
Works!!. On 04/14/2012 08:00 PM, dan (ddp) wrote: It should work. On Apr 14, 2012 1:57 PM, "carlopmart" mailto:carlopm...@gmail.com>> wrote: Hi all, I have configured a centralized agent configuration. But i have 5 freebsd servers that I need to control using

[ossec-list] Question about freebsd agents

2012-04-14 Thread carlopmart
Hi all, I have configured a centralized agent configuration. But i have 5 freebsd servers that I need to control using same method. For windows and linux is possible to put in agent.conf this: or but what about freebsd?? works?? thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Problems to generate daily reports

2012-04-05 Thread carlopmart
can I consolidate in one report several group alerts?? -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Problems to generate daily reports

2012-04-05 Thread carlopmart
eted. Creating output... 2012/04/05 00:02:33 ossec-monitord: WARN: Report taking too long to complete. Waiting for it to finish... last report is generated, but not the other two ... Maybe I have missconfigured something?? -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Is a new release planned?

2011-11-11 Thread carlopmart
Hi all, During next month I need to install two ossec servers with several agents associated. Is it planned to release a new version soon?? If not, is it safe to use a recent snapshot?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] 3WoO Day 4: What bugs you: problems, challenges and room for improvement.

2011-10-27 Thread carlopmart
On 10/27/2011 01:55 AM, Michael Starks wrote: On 10/26/2011 07:15 AM, carlopmart wrote: b) Ability to use agent collectors. For example for remote locations, one server acts a collector for a remote LAN and forwards all alerts, logs, etc to the central OSSEC server. You should be able do this

Re: [ossec-list] 3WoO Day 4: What bugs you: problems, challenges and room for improvement.

2011-10-26 Thread carlopmart
On 10/26/2011 08:33 PM, dan (ddp) wrote: Please excuse my ignorance. I'll take notes. :) On Wed, Oct 26, 2011 at 8:15 AM, carlopmart wrote: On 10/26/2011 01:00 PM, Michael Starks wrote: List the most annoying bugs. What makes OSSEC difficult to use? What is the biggest area for improv

Re: [ossec-list] 3WoO Day 4: What bugs you: problems, challenges and room for improvement.

2011-10-26 Thread carlopmart
forwards all alerts, logs, etc to the central OSSEC server. c) That there is the ability to store events, alerts, etc on the client side for example during seven days until the central OSSEC server is restored due to a failure. .. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] OSSEC server as a forwarder host

2011-06-02 Thread carlopmart
On 06/02/2011 08:07 PM, dan (ddp) wrote: On Thu, Jun 2, 2011 at 1:23 PM, carlopmart wrote: On 06/02/2011 07:02 PM, Daniel Cid wrote: Would the multi-server architecture do what you want? http://dcid.me/2008/08/multi-server-architecture/ thanks, Yes, exactly, this is what I need, but

Re: [ossec-list] OSSEC server as a forwarder host

2011-06-02 Thread carlopmart
, etc until ossec-central-server will be up. Thanks Daniel. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] OSSEC server as a forwarder host

2011-06-01 Thread carlopmart
Hi all, Is it possible to install an OSSEC server that acts like a forwarder for a group agents?? Similar that splunk does: http://www.splunk.com/base/Documentation/latest/Deploy/Introducingtheuniversalforwarder Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] New release soon?

2011-05-13 Thread carlopmart
Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] ignore directory issue

2011-04-12 Thread carlopmart
agent.conf file ... Bye. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] ignore

2011-04-06 Thread carlopmart
/agent-management.html). Server configuration goes apart. Bye. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Include SL based distros on cis_rhelX_linux_rcl.txt for the next ossec release

2011-03-28 Thread carlopmart
://linux.cern.ch) is: [root@lorien]# cat /etc/redhat-release Scientific Linux CERN SLC release 6.0 (Carbon) -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Include SL based distros on cis_rhelX_linux_rcl.txt for the next ossec release

2011-03-26 Thread carlopmart
Hi Daniel and member lists, Daniel, is it possible to include ScientificLinux and derived distros like SL CERN (http://linux.cern.ch) under cis_rhelX_linux_rcl.txt audit file for the next ossec release?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Some changelog about next ossec release version

2011-03-22 Thread carlopmart
Hi all, Where can I find a changelog or new features about next ossec version?? I am very interested to know if it is possible to install new ossec version in a HA environment in more accurately manner than now. Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] ossec-reportd needs to start manually?

2011-03-10 Thread carlopmart
On 03/10/2011 03:53 PM, dan (ddp) wrote: reportd isn't really a daemon like the others, it's supposed to run sometime around midnight. It also looks like you have 2 sections squished together. Then, do I need to create one section for each report?? -- CL Martinez carlopmart

[ossec-list] ossec-reportd needs to start manually?

2011-03-10 Thread carlopmart
-reportd doesn't appears on start section to be launched. Do I need to launch ossec-reportd manually? Can I add "ossec-reportd" on the start section?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Ossec agent for windows on a Windows 2008 R2 SP1

2011-03-09 Thread carlopmart
2008 64bit only. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Ossec agent for windows on a Windows 2008 R2 SP1

2011-03-09 Thread carlopmart
Hi all, Somebody have tried to install ossec agent for windows 2.5.1 on a Windows 2008 R2 SP1 server?? I see on ossec's website that it is a 32 bit client. Can I expect some problem?? Many thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Restart ossec server when agent has added?

2011-03-08 Thread carlopmart
On 03/08/2011 04:19 PM, Michael Starks wrote: On Tue, 08 Mar 2011 14:39:20 +0100, carlopmart wrote: Hi all, Is it need to restart an ossec server when an agent is added? After add an agent, my ossec server says: Really?? Well, not exactly. You should only have to restart the manager

[ossec-list] Restart ossec server when agent has added?

2011-03-08 Thread carlopmart
agent (A). (E)xtract key for an agent (E). (L)ist already added agents (L). (R)emove an agent (R). (Q)uit. Choose your action: A,E,L,R or Q: q ** You must restart the server for your changes to have effect. manage_agents: Exiting .. Really?? -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Maybe a false positive with rule 510

2011-03-05 Thread carlopmart
kind of strange interaction between /dev/shm, the clustering stuff, and OSSEC's checks. I'd hit up support at redhat to see if they have any thoughts on the matter. Many thanks Dan. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Re: Maybe a false positive with rule 510

2011-03-04 Thread carlopmart
On 03/03/2011 06:29 PM, carlopmart wrote: Hi all, Recentlly my OSSEC server fired some strange alarms like this: ** Alert 1299172717.237104: mail - ossec,rootcheck, 2011 Mar 03 18:18:37 (rhelclunode02) 172.25.50.15->rootcheck Rule: 510 (level 7) -> 'Host-based anomaly dete

Re: [ossec-list] ossec centralized configuration

2011-03-03 Thread carlopmart
_rcl.txt /var/ossec/etc/shared/cis_rhel_linux_rcl.txt /var/ossec/etc/shared/cis_rhel5_linux_rcl.txt yes syslog /var/log/messages syslog /var/log/secure syslog /var/log/maillog -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Question

2011-03-03 Thread carlopmart
On 03/03/2011 09:24 PM, Nate Woodward wrote: Hello, Quick question: Can you specify multiple files in the section of ossec.conf/agent.conf, or is only one allowed? You can specify multiple files ... -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] ossec centralized configuration

2011-03-03 Thread carlopmart
vulnerability tools. Just wanted to know its possible to disable AR via agent.conf or not ? -Satish On Thu, Mar 3, 2011 at 2:30 PM, carlopmart wrote: Try to put active response section on ossec.conf on the agent side and restart agent. On 03/03/2011 08:25 PM, satish patel wrote: Yes, I reload agent

Re: [ossec-list] ossec centralized configuration

2011-03-03 Thread carlopmart
started at: Thu Mar 3 09:55:00 2011 On Thu, Mar 3, 2011 at 1:25 PM, carlopmart wrote: On 03/03/2011 07:05 PM, satish patel wrote: Thanks bro, That has been fix. Now i want to disable AR on specific agent and i add following code in agent.conf but it doesn't working... still AR is acti

Re: [ossec-list] ossec centralized configuration

2011-03-03 Thread carlopmart
n the agent side if needed ... -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] ossec centralized configuration

2011-03-03 Thread carlopmart
-- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Maybe a false positive with rule 510

2011-03-03 Thread carlopmart
8742 /dev/shm/request_buffer-DjNinS dlm_contr 1216root DEL REG 0,15 8736 /dev/shm/request_buffer-JI55eG gfs_contr 1270root DEL REG 0,15 9002 /dev/shm/request_buffer-Gmeo3Q Maybe is it a false positive?? can I configure more verbose options for

Re: [ossec-list] ossec centralized configuration

2011-03-03 Thread carlopmart
vidual agents ossec.conf file ? using centralized configuration, only in agents.conf. anybody has example files please post me i will appreciate your great help -Satish -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Local_rules.xml ... public repository ?

2011-02-25 Thread carlopmart
On 02/25/2011 08:11 PM, dan (ddp) wrote: People have shared rules on this list, the dev list, the IRC channel, and probably other methods. Does anyone think an ossec-rules mailing list would be useful? IMHO, very very useful. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Maybe a problem with a squid logs??

2011-02-24 Thread carlopmart
?? Maybe I have defined bad my logfiles under agent.conf?? squid /var/log/squid/anon/*.log Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] ossec-syscheckd crashed using agent centralized configuration

2011-02-24 Thread carlopmart
ossec-execd(1350): INFO: Active response disabled. Exiting. 2011/02/24 17:14:40 ossec-syscheckd(1702): INFO: No directory provided for syscheck to monitor. Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Re: Modifiying agent.conf without stopping OSSEC server

2011-02-24 Thread carlopmart
On 02/24/2011 10:35 AM, carlopmart wrote: Hi all, When agent.conf file is modifiyed, is neccessary to restart all services on the OSSEC server side or only ossec-remoted/ossec-monitord daemons ?? Or is agent.conf automatically read by the the ossec server and push it on the ossec client (or

[ossec-list] Re: ossec-syscheckd crashed using agent centralized configuration

2011-02-24 Thread carlopmart
On 02/24/2011 05:54 PM, carlopmart wrote: On 02/24/2011 05:28 PM, carlopmart wrote: Hi all, Like I explain in another email I need to setup agent centralized configuration for my ossec client. With one ossec client that previously I have installed withou configuring this feature at first time

[ossec-list] Re: ossec-syscheckd crashed using agent centralized configuration

2011-02-24 Thread carlopmart
On 02/24/2011 05:28 PM, carlopmart wrote: Hi all, Like I explain in another email I need to setup agent centralized configuration for my ossec client. With one ossec client that previously I have installed withou configuring this feature at first time, all works ok, but with a new ossec

[ossec-list] Modifiying agent.conf without stopping OSSEC server

2011-02-24 Thread carlopmart
carlopmart {at} gmail {d0t} com

[ossec-list] Some questions abou agent centralization

2011-02-23 Thread carlopmart
,/usr/sbin,/bin,/sbin /etc/adjtime /etc/aliases.db /etc/hosts.deny /etc/lvm/cache/.cache /etc/mtab /var/log/some.log syslog /var/log/another.log syslog Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] OSSEC and Cloud Systems

2011-02-22 Thread carlopmart
carlopmart {at} gmail {d0t} com

Re: [ossec-list] Re: high availability solution

2011-01-13 Thread carlopmart
m to sync client.keys file between all the servers that makes HA?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Audit log and OSSEC unde RHEL6

2010-12-22 Thread carlopmart
On 12/22/2010 10:19 PM, dan (ddp) wrote: Many thanks for your help dan. -- CL Martinez carlopmart {at} gmail {d0t} com Not a problem. Can you post your final decoder for the archives? It might help someone else looking to do the same thing. Of course, no problem. Here it is: ^type=\S

Re: [ossec-list] Audit log and OSSEC unde RHEL6

2010-12-22 Thread carlopmart
On 12/22/2010 10:11 PM, carlopmart wrote: On 12/22/2010 09:54 PM, dan (ddp) wrote: On Wed, Dec 22, 2010 at 3:17 PM, carlopmart wrote: On 12/22/2010 08:44 PM, dan (ddp) wrote: I don't have access to ossec-logtest right now, so you'll have to do some testing with that on your own.

Re: [ossec-list] Audit log and OSSEC unde RHEL6

2010-12-22 Thread carlopmart
On 12/22/2010 09:54 PM, dan (ddp) wrote: On Wed, Dec 22, 2010 at 3:17 PM, carlopmart wrote: On 12/22/2010 08:44 PM, dan (ddp) wrote: I don't have access to ossec-logtest right now, so you'll have to do some testing with that on your own. Everything I'm writing in this m

Re: [ossec-list] Audit log and OSSEC unde RHEL6

2010-12-22 Thread carlopmart
On 12/22/2010 08:44 PM, dan (ddp) wrote: I don't have access to ossec-logtest right now, so you'll have to do some testing with that on your own. Everything I'm writing in this mail is untested. ;) On Wed, Dec 22, 2010 at 12:41 PM, carlopmart wrote: Hi all, I am trying t

[ossec-list] Audit log and OSSEC unde RHEL6

2010-12-22 Thread carlopmart
ser pid=14323 uid=0 auid=1000 ses=1 msg='cwd="/tmp/f/csf" cmd=2F62696E2F6C73202D6C61 terminal=pts/3 res=success' Do I need to change user for acct on my local_rules.xml?? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Questions about when an OSSEC server is down

2010-12-17 Thread carlopmart
On 12/17/2010 05:10 PM, dan (ddp) wrote: On Fri, Dec 17, 2010 at 10:55 AM, carlopmart wrote: On 12/17/2010 04:32 PM, dan (ddp) wrote: On Fri, Dec 17, 2010 at 4:52 AM, carlopmartwrote: Hi all, I have installed two ossec servers to provide HA for several agents. Using a software load

Re: [ossec-list] Questions about when an OSSEC server is down

2010-12-17 Thread carlopmart
On 12/17/2010 04:32 PM, dan (ddp) wrote: On Fri, Dec 17, 2010 at 4:52 AM, carlopmart wrote: Hi all, I have installed two ossec servers to provide HA for several agents. Using a software load balancer, this scenario works as I expected. But I have a problem with six servers (all linux based

[ossec-list] Questions about when an OSSEC server is down

2010-12-17 Thread carlopmart
will get all the logs of the agent, correct? Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 08:49 PM, Michael Starks wrote: On Wed, 15 Dec 2010 18:38:23 +0100, carlopmart wrote: Hi all, Somebody know if it is possible to do two different installations on the same host, one as an agent and another as a server?? Sure: http://www.immutablesecurity.com/index.php/2010/10

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
ed it, and doesn't works. Syscheckd is started ... -- CL Martinez carlopmart {at} gmail {d0t} com But does it do anything? If the process runs but doesn't do anything does it matter that it runs? You can also stop it from running by modifying the ossec-control script. It's an e

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 07:38 PM, carlopmart wrote: Thanks Dan. I have installed ossec as a server disabling rootchek, syscheck and active response. But when I launch ossec init script syscheckd is started. How can I prevent to start syscheckd?? Thanks. Ok, It appears that the agent and the server

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
On 12/15/2010 08:10 PM, dan (ddp) wrote: On Wed, Dec 15, 2010 at 1:38 PM, carlopmart wrote: On 12/15/2010 07:14 PM, d.asse...@cgi.com wrote: And the answer is E But I did remove some functionality from the server side I'm writhing a doc on it for the deployment team But bas

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
nks. -- CL Martinez carlopmart {at} gmail {d0t} com

Re: [ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
side. c) Change ossec user's home to a different directories that ossec's install script configure. d) Add server as an agent using manage_agents script. e) Install ossec again but this time as an agent ... Could it work? -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Server and agent at the same time on the same host

2010-12-15 Thread carlopmart
with OSSEC these three hosts. Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Using OSSEC with natted agents

2009-04-28 Thread carlopmart
Hi all, Is it possible to configure some ossec natted agents to connect to an ossec server? How can I configure ossec server to distinguish them?? I have five linux hosts to monitor, but they are behind a natted firewall. Many thanks -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] OSSEC 1.x or 2.x under RedHat Cluster Suite

2009-02-28 Thread carlopmart
Hi all, Somebody have tried to install ossec 1.x or 2.x under RedHat Cluster Suite (4.x/5.x)?? I need to support HA configuration for my agents and servers .. Thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Maybe OT: Start Ossec Agent 5 min later after system boots

2008-11-21 Thread carlopmart
Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Re: Updating from 1.5.1 to 1.6

2008-09-10 Thread carlopmart
Kevin Reiter wrote: > carlopmart wrote: > : Hi all, > : > : How can I update from 1.5.1 to 1.6 release?? I can't find anything > : about this on OSSEC docs ... > > Just run the installer - it will detect a previous version and ask you if > you'd like to upgr

[ossec-list] Updating from 1.5.1 to 1.6

2008-09-10 Thread carlopmart
Hi all, How can I update from 1.5.1 to 1.6 release?? I can't find anything about this on OSSEC docs ... -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Errors from ossec agnet

2008-07-03 Thread carlopmart
R: Unable to connect to active response queue. How can I fix this?? On server side I can't see any error ... -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Re: Link to ossec and snort paper is broken

2008-07-03 Thread carlopmart
List Subscriptions wrote: > I believe this is the paper you're looking for. > > Cheers! > > On Thu, Jul 3, 2008 at 11:38 AM, carlopmart <[EMAIL PROTECTED]> wrote: >> Hi all, >> >> I see this link about configure snort with ossec, but link is b

[ossec-list] Link to ossec and snort paper is broken

2008-07-03 Thread carlopmart
Hi all, I see this link about configure snort with ossec, but link is broken ... Somebody knows where can I find original doc?? Many thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Re: High cpu usage under RHEL5.2 using ossec 1.5.1 (SOLVED)

2008-07-03 Thread carlopmart
Ok, I have found whereis the problem: my laptop mounts a remote nfs share that contains 20 iso images using 75GB of data ...when syscheck starts, checks all in this nfs share. I have included on ignore section and now all works as expected ... Sorry for the noise ... carlopmart wrote

[ossec-list] Re: High cpu usage under RHEL5.2 using ossec 1.5.1

2008-07-03 Thread carlopmart
/etc/dumpdates /etc/blkid/blkid.tab /etc/aliases.db /etc/prelink.cache /data/vmguests yes no carlopmart wrote: > > Hi Daniel, > > Yes I have 3 vm guests under vmware workstation 6.5: > > 16K ./lost+found > 32G ./el5updates

[ossec-list] Re: High cpu usage under RHEL5.2 using ossec 1.5.1

2008-07-03 Thread carlopmart
Anyone else seeing > this behavior? > > *btw, can you provide more information to us? ( > http://www.ossec.net/wiki/index.php/Community_manual:BugReport ) > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > > On Fri, Jun 27, 2008 at 11:37 A

[ossec-list] Re: High cpu usage under RHEL5.2 using ossec 1.5.1

2008-06-27 Thread carlopmart
Please any hints about this?? carlopmart wrote: > Hi Daniel, > > I have compiled and executed ossec-rootchek with these results: > > [EMAIL PROTECTED] rootcheck-1.5]$ sudo ./ossec-rootcheck > > ** Starting Rootcheck v1.5 by Daniel B. Cid** > ** http://www.oss

[ossec-list] Re: High cpu usage under RHEL5.2 using ossec 1.5.1

2008-06-25 Thread carlopmart
down after a while? > > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > On Sun, Jun 22, 2008 at 7:57 AM, carlopmart <[EMAIL PROTECTED]> wrote: >> carlopmart wrote: >>> Hi all, >>> >>> Tody I have installed oss

[ossec-list] Re: High cpu usage under RHEL5.2 using ossec 1.5.1

2008-06-22 Thread carlopmart
carlopmart wrote: > Hi all, > > Tody I have installed ossec 1.5.1. When syscheckd process starts > consumes all free cpu usage (sometimes arrives to 99% or 100%)... Using > ossec 1.5, syscheckd doesn't produce this type of problem ... How can I > fix this?? > &

[ossec-list] High cpu usage under RHEL5.2 using ossec 1.5.1

2008-06-20 Thread carlopmart
Hi all, Tody I have installed ossec 1.5.1. When syscheckd process starts consumes all free cpu usage (sometimes arrives to 99% or 100%)... Using ossec 1.5, syscheckd doesn't produce this type of problem ... How can I fix this?? Many thanks. -- CL Martinez carlopmart {at} gmail {d0t} com

[ossec-list] Re: high availability solution

2008-05-27 Thread carlopmart
n CentOS .... -- CL Martinez carlopmart {at} gmail {d0t} com

  1   2   >