Re: OSSEC Events not being logged
"Hammond, Stanley" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
I ran 'prelude-manager --debug' and I think I see the problem. OSSEC is sending the alerts to the prelude-manager, but the create_time for the alerts is different than the other sensors. From OSSEC the create time for each event (except the restart of OSSEC) is listed as "create_time: 01/01/1970 00:00:00.0 +00:00"
A copy of the debugging information with the OSSEC events are listed below:
heartbeat:
messageid: 638fd5ce-6218-11dd-9260
analyzer(0):
analyzerid: 2694217011374565
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.14.1
class: Concentrator
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: prelude-manager
pid: 21670
path: /usr/local/bin/prelude-manager
analyzer(1):
analyzerid: 3163845926531586
name: OSSEC
manufacturer: http://www.ossec.net
model: Ossec
version: v1.5.1
class: Host IDS, File Integrity Checker, Log Analyzer
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: ossec-analysisd
pid: 21736
path: /opt/ossec/bin/ossec-analysisd
create_time: 04/08/2008 07:27:58.9031 -04:00
analyzer_time: 04/08/2008 07:27:58.9170 -04:00
heartbeat_interval: 600
additional_data(0):
type: string (0)
meaning: Analyzer status
data: starting
additional_data(1):
type: string (0)
meaning: Analyzer SHA1
data: a4be63f760c21e565a08f13045b0ad97486f83e7
version: <empty>
...
alert:
messageid: 6a12a6b0-6218-11dd-9260
analyzer(0):
analyzerid: 2694217011374565
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.14.1
class: Concentrator
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: prelude-manager
pid: 21670
path: /usr/local/bin/prelude-manager
analyzer(1):
analyzerid: 3163845926531586
name: OSSEC
manufacturer: http://www.ossec.net
model: Ossec
version: v1.5.1
class: Host IDS, File Integrity Checker, Log Analyzer
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: ossec-analysisd
pid: 21736
path: /opt/ossec/bin/ossec-analysisd
create_time: 01/01/1970 00:00:00.0 +00:00
classification:
text: Ossec server started.
analyzer_time: 04/08/2008 11:28:08.932809 +00:00
source(0):
spoofed: no (2)
target(0):
decoy: unknown (0)
node:
category: unknown (0)
address(0):
category: unknown (0)
address: prelude
service:
name: prelude
assessment:
impact:
severity: info (1)
completion: succeeded (2)
type: other (0)
description: Ossec server started.
additional_data(0):
type: string (0)
meaning: Source file
data: ossec-monitord
additional_data(1):
type: string (0)
meaning: Full Log
data: ossec: Ossec started.
version: <empty>
...
alert:
messageid: 76fba2dc-6218-11dd-9260
analyzer(0):
analyzerid: 2694217011374565
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.14.1
class: Concentrator
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: prelude-manager
pid: 21670
path: /usr/local/bin/prelude-manager
analyzer(1):
analyzerid: 3163845926531586
name: OSSEC
manufacturer: http://www.ossec.net
model: Ossec
version: v1.5.1
class: Host IDS, File Integrity Checker, Log Analyzer
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: ossec-analysisd
pid: 21736
path: /opt/ossec/bin/ossec-analysisd
create_time: 01/01/1970 00:00:00.0 +00:00
classification:
text: Windows Logon Success.
analyzer_time: 04/08/2008 11:28:30.592310 +00:00
source(0):
spoofed: no (2)
target(0):
decoy: unknown (0)
node:
category: unknown (0)
address(0):
category: unknown (0)
address: (server) 10.0.0.1
service:
name: (server) 10.0.0.1->WinEvtLog
assessment:
impact:
severity: info (1)
completion: succeeded (2)
type: other (0)
description: Windows Logon Success.
additional_data(0):
type: string (0)
meaning: Source file
data: (server) 10.0.0.1->WinEvtLog
additional_data(1):
type: string (0)
meaning: Full Log
data: WinEvtLog: Security: AUDIT_SUCCESS(528): Security: username: CCCC: server: Successful Logon: User Name: username Domain:
CCCC Logon ID: (0x0,0x2671731) Logon Type: 10 Logon Process: User32 Authentication Package: Negotiate Workstation Name: server Logon GUID: {a8cfe502-1b42-3679-af8d-026403b0a141} Caller User Name: server$ Caller Domain: CCCC Caller Logon ID: (0x0,0x3E7) Caller Process ID: 4116 Transited Services: - Source Network Address: 10.0.0.2 Source Port: 10045
version: <empty>
...
alert:
messageid: 79616228-6218-11dd-9260
analyzer(0):
analyzerid: 2694217011374565
name: prelude-manager
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.14.1
class: Concentrator
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: prelude-manager
pid: 21670
path: /usr/local/bin/prelude-manager
analyzer(1):
analyzerid: 3163845926531586
name: OSSEC
manufacturer: http://www.ossec.net
model: Ossec
version: v1.5.1
class: Host IDS, File Integrity Checker, Log Analyzer
ostype: Linux
osversion: 2.6.22-14-generic
process:
name: ossec-analysisd
pid: 21736
path: /opt/ossec/bin/ossec-analysisd
create_time: 01/01/1970 00:00:00.0 +00:00
classification:
text: Windows error event.
analyzer_time: 04/08/2008 11:28:34.614564 +00:00
source(0):
spoofed: no (2)
target(0):
decoy: unknown (0)
node:
category: unknown (0)
address(0):
category: unknown (0)
address: (server) 10.0.0.1
service:
name: (server) 10.0.0.1->WinEvtLog
assessment:
impact:
severity: low (2)
completion: succeeded (2)
type: other (0)
description: Windows error event.
additional_data(0):
type: string (0)
meaning: Source file
data: (server) 10.0.0.1->WinEvtLog
additional_data(1):
type: string (0)
meaning: Full Log
data: WinEvtLog: System: ERROR(1111): TermServDevices: (no user): no domain: server: Driver CutePDF Writer required for printer CutePDF Writer is unknown. Contact the administrator to install the driver before you log in again.
version: <empty>
...
-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Friday, August 01, 2008 7:31 PM
To: [email protected]; Hammond, Stanley
Subject: Re: [prelude-user] OSSEC Events not being logged
On Fri 1/08/08 20:29, "Hammond, Stanley" [email protected] wrote:
> Hello,
Hello Stan,
>
> Has anyone else had this problem? Any thoughts/solutions?
>
I did not see this problem yet. Can you run prelude-manager in debug mode (prelude-manager --debug) and tell me if you see alerts being logged (Starting OSSEC generates an alert) ?
Thanks,
Sebastien.
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user