We're using OSSEC 2.8.3 in standalone mode and failing to get syscheck to
be useful. We *are* getting other alerts via both the log file and email.
We're stumped. Any insight would be appreciated.
The ossec.conf configuration that is relevant. There is no fine-grained
"email-alerts" section defined.
<global>
<email_notification>yes</email_notification>
<email_to>ossec-repo...@ourhost.com</email_to>
<smtp_server>mail.ourhost.com.</smtp_server>
<email_from>oss...@ourhost.com</email_from>
</global>
<syscheck>
<frequency>300</frequency>
<alert_new_files>yes</alert_new_files>
<directories check_all="yes"
realtime="yes">/home/jblaine/test-checksum-area</directories>
</syscheck>
<alerts>
<log_alert_level>1</log_alert_level>
<email_alert_level>7</email_alert_level>
</alerts>
The trigger test case. I modify 2 files monitored by syscheck.
[jblaine@ourhost ~]$ date
Tue Jun 14 12:23:19 EDT 2016
[jblaine@ourhost ~]$ pwd
/home/jblaine
[jblaine@ourhost ~]$ cd test-checksum-area/
[jblaine@ourhost test-checksum-area]$ ls
a-file b-file
[jblaine@ourhost test-checksum-area]$ echo 32eh23oeh23oe2o23o > a-file
[jblaine@ourhost test-checksum-area]$ echo dfiosdafo > b-file
[jblaine@ourhost test-checksum-area]$
And the local_rules.xml where I do the common thing of increasing the level
for file additions for syscheck. This isn't relevant to this test case, as
we're not creating any new files, but I thought I would mention it for
completeness:
<rule id="554" level="10" overwrite="yes">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,</group>
</rule>
We have not touched any syscheck rules in ossec_rules.xml. They all remain
at level 7 per default.
Yes, I've restarted ossec after the configurations above.
I wait over 5 minutes, per the 300sec syscheck interval. I see that
syscheck ran at 12:27
2016/06/14 12:27:16 ossec-syscheckd: INFO: Starting syscheck scan.
2016/06/14 12:27:38 ossec-syscheckd: INFO: Ending syscheck scan.
I see no alert matching /home*
[jblaine@ourhost test-checksum-area]$ sudo grep /home
/var/ossec/logs/alerts/alerts.log
[jblaine@ourhost test-checksum-area]$
Likewise, I get no alert email.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
