Team,
I have recently installed an standalone OSSEC 3.2 Server and added my
Active Directory servers as agents. I have also installed OSSEC AGent v3.2
or my Domain Controllers and started the agent service.
I don't see any logs in the archive.log or ossec.log file. Furthermore,
When I run the
On Mon, Apr 8, 2019 at 10:13 AM Abid Raza
wrote:
>
> Team,
>
> I have recently installed an standalone OSSEC 3.2 Server and added my Active
> Directory servers as agents. I have also installed OSSEC AGent v3.2 or my
> Domain Controllers and started the agent service.
>
> I don't see any logs in
On Tue, Apr 9, 2019 at 3:09 AM Abid Raza
wrote:
>
> Hi,
>
> List-agents -n shows nothing. Please see the attached snapshot.
That's strange. Verify the agents are added by checking
`/var/ossec/etc/client.keys` (don't post that, it has secrets)
Nothing related in the ossec.log that I saw, but image
Hi,
I can see the keys in the client.keys file. Could you please let me know
the steps to check the OSSEC Traffic you mentioned in your last email?
On Tuesday, 9 April 2019 17:19:35 UTC+5, dan (ddpbsd) wrote:
>
> On Tue, Apr 9, 2019 at 3:09 AM Abid Raza
> > wrote:
> >
> > Hi,
> >
> > List-
Could you please help me here?
On Thursday, 11 April 2019 17:17:04 UTC+5, Abid Raza wrote:
>
> Hi,
>
> I can see the keys in the client.keys file. Could you please let me know
> the steps to check the OSSEC Traffic you mentioned in your last email?
>
> On Tuesday, 9 April 2019 17:19:35 UTC+5, d
On Thu, Apr 11, 2019 at 8:17 AM Abid Raza
wrote:
>
> Hi,
>
> I can see the keys in the client.keys file. Could you please let me know the
> steps to check the OSSEC Traffic you mentioned in your last email?
>
Replace INTERFACE with the name of your network interface.
`sudo tcpdump -nni INTERFAC
PFA the result.
On Saturday, 13 April 2019 07:08:51 UTC+5, dan (ddpbsd) wrote:
>
> On Thu, Apr 11, 2019 at 8:17 AM Abid Raza
> > wrote:
> >
> > Hi,
> >
> > I can see the keys in the client.keys file. Could you please let me know
> the steps to check the OSSEC Traffic you mentioned in your l
any update Sir.
On Tuesday, 16 April 2019 17:50:57 UTC+5, Abid Raza wrote:
>
> PFA the result.
>
> On Saturday, 13 April 2019 07:08:51 UTC+5, dan (ddpbsd) wrote:
>>
>> On Thu, Apr 11, 2019 at 8:17 AM Abid Raza
>> wrote:
>> >
>> > Hi,
>> >
>> > I can see the keys in the client.keys file. Co
On Mon, Apr 22, 2019 at 4:14 AM Abid Raza
wrote:
>
> any update Sir.
>
>From the tiny picture you posted, it doesn't look like OSSEC traffic
is making it to (or from?) that system.
If that was from the OSSEC server, something seems to be blocking the
traffic somewhere between the agents and the s