Quantcast
Channel: MarsHut
Viewing all articles
Browse latest Browse all 6551

help ,The system checks not receive notification

$
0
0
I have installed OSSEC, other functions normally. But the newly added files
and folders can not be reminded, how to set?
Server Software version: OSSEC 2.8
Server System Version: CENTOS6.4 Agent Version: CENTOS6.4
I configured according to the documentation:
http://ossec-docs.readthedocs.org/en/latest/manual/syscheck/index.html

My method:

1, the increase in local_rules.xml
<rule id="554" level="12" overwrite="yes">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,</group>
</rule>
2, an increase in the agent side ossoec.conf
<syscheck>
<frequency>20</frequency>
<alert_new_files>yes</alert_new_files>
<directories check_all="yes">/var/www</directories>
<ignore>/ett/mtab</ignore>
</syscheck>

3, Scan now
/opt/ossec/bin/agent_control -r -u 001
/opt/ossec/bin/agent_control -lc (Show has been updated)

But monitoring page see any relevant records also receive mail

You received this message because you are subscribed to the Google Groups "ossec-list" group.

For more options, visit https://groups.google.com/d/optout.

Viewing all articles
Browse latest Browse all 6551

Latest Images

Trending Articles



Latest Images