routers and ossec

[Adam]

so i have a router that allows me to report to a syslog server but dose not have ssh. can i set up ossec with this or does the agentless setup only work over ssh?

[dan (ddp)]

What do you want the agentless support to do? How would agentless
connect to the system to do this?

OSSEC has the capability to look at the syslog messages.

[dan (ddp)]

On Fri, Oct 5, 2012 at 12:09 PM, Tom Hangstin <emada...@gmail.com> wrote:
> so i take it the answer is no?
>

Or people are busy. After seeing your comment though I decided to
respond. Apologies for the delay, but I believe all SLAs have been
met.

[Adam]

yeah ill just setup my ossec server as a syslog server and have it read the router logs from there.

[Michael Barrett]

It seems to be messed up.  The agent ID used to default to the next number, now it seems to be stuck on 1025


____________________________________________
Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation
270 E. Kilbourn Ave. | Milwaukee, WI  53202 USA | ( 1.414.347.6271 | 7 1.888.601.4440 | * michael...@MGIC.com

This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message.

[Scott Klauminzer]

Is it possible you have set setmaxagents to 1024 on make?

Scott

On Oct 5, 2012, at 10:00 AM, Michael Barrett <Michael...@mgic.com> wrote:

It seems to be messed up.  The agent ID used to default to the next number, now it seems to be stuck on 1025

<Mail Attachment.gif>

[Michael Barrett]

set to 2048

____________________________________________
Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation
270 E. Kilbourn Ave. | Milwaukee, WI  53202 USA | ( 1.414.347.6271 | 7 1.888.601.4440 | * michael...@MGIC.com

This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message.

From:	Scott Klauminzer <sklau...@gmail.com>
To:	ossec...@googlegroups.com
Date:	10/05/2012 02:26 PM
Subject:	Re: [ossec-list] where does this number come from
Sent by:	ossec...@googlegroups.com

---

[sklau...@gmail.com]

And open file max on the Manager system is set to?

Scott 

[Michael Barrett]

Anyone have any insight on how to change/resolve this auto number issue?

____________________________________________
Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation
270 E. Kilbourn Ave. | Milwaukee, WI  53202 USA | ( 1.414.347.6271 | 7 1.888.601.4440 | * michael...@MGIC.com

This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message.

From:	Scott Klauminzer <sklau...@gmail.com>
To:	ossec...@googlegroups.com
Date:	10/05/2012 02:26 PM
Subject:	Re: [ossec-list] where does this number come from
Sent by:	ossec...@googlegroups.com

---

[dan (ddp)]

On Wed, Oct 10, 2012 at 8:59 AM, Michael Barrett
<Michael...@mgic.com> wrote:
>
>
> Anyone have any insight on how to change/resolve this auto number issue?

I've seen it, but it never bothered me enough to look into. I'd start
in src/addagent.