OSSEC Events not being logged
"Hammond, Stanley" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hello, I have installed the newest OSSEC version (1.5.1) as a server on the same server running Prelude-manager (0.9.11.2) and PrewikkaPro (0.9.15.2). I compiled OSSEC with prelude support, was able to register the sensor and OSSEC does appear in the agent listing on PrewikkaPro. So OSSEC does seem to connect to the Prelude-manager and Prelude-manager acknowledges the OSSEC sensor. OSSEC is triggering events and receiving events from a Windows server which I can receive via email, but the events do not seem to be received by the Prelude-manager. Is there something that I missing? My ossec.conf file has <prelude_output>yes</prelude_output> in the global section and when I start OSSEC it comes back with the following: Starting OSSEC HIDS v1.5.1 (by Third Brigade, Inc.)... 01 Aug 14:25:47 (process:15451) INFO: Connecting to 127.0.0.1:4690 prelude Manager server. 01 Aug 14:25:47 (process:15451) INFO: TLS authentication succeed with Prelude Manager. Started ossec-maild... Started ossec-execd... Started ossec-analysisd... Started ossec-logcollector... Started ossec-remoted... Started ossec-syscheckd... Started ossec-monitord... Completed. Has anyone else had this problem? Any thoughts/solutions? Thanks, Stan _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user