Format email output from ossec-reportd and category list

[Grant Leonard]

Good morning

After the /var/ossec/bin/ossec-reportd runs, the tallies are left aligned and when emailed the spacing is not kept from stdout to email

Thus stdout looks like this

Top entries for 'Group':
------------------------------------------------
pci_dss_10.6.1                                                                |801     |
audit                                                                         |799     |
audit_selinux                                                                 |799     |

How ever email looks like this


Top entries for 'Group':
------------------------------

------------------
pci_dss_10.2.5                                                                |110     |
windows                                                                       |110     |
authentication_success                                                        |85      |

How can we force "fixed width" or "Courier New" style formatting in email to prevent this?

Additionally, what are the full list of categories found here

https://documentation.wazuh.com/2.0/user-manual/reference/ossec-conf/reports.html#category

Thanks!!

[dan (ddp)]

I'm not sure there's a way to do that, not universally. You could pipe
the reportd output through a script that formats it nicer though. It
shouldn't be too difficult.

>
> Additionally, what are the full list of categories found here
>
> https://documentation.wazuh.com/2.0/user-manual/reference/ossec-conf/reports.html#category
>

I don't know about Wazuh, but for OSSEC they probably match the groups
and categories in the rules files.

> Thanks!!
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Grant Leonard]

Thank you, I will try piping output somewhere else first.

Please note the full list does not exist there, I started there, it shows

category

Filter by group/category.

Default value	n/a
Allowed values	Any category used is allowed.

categories are then user defined, correct? I can grep for the existing list

Thanks!

[dan (ddp)]

On Thu, Nov 9, 2017 at 9:27 AM, Grant Leonard
<gr...@castraconsulting.com> wrote:
>
> Thank you, I will try piping output somewhere else first.
>
> Please note the full list does not exist there, I started there, it shows
>
> category
>
> Filter by group/category.
>
> Default value n/a
> Allowed values Any category used is allowed.
>
>
>
> categories are then user defined, correct? I can grep for the existing list
>

I believe you can create your own. It'd be simple to test.