routers and ossec

37 views
Skip to first unread message

Adam

unread,
Oct 4, 2012, 2:21:44 PM10/4/12
to ossec...@googlegroups.com
so i have a router that allows me to report to a syslog server but dose not have ssh. can i set up ossec with this or does the agentless setup only work over ssh?

dan (ddp)

unread,
Oct 5, 2012, 12:13:33 PM10/5/12
to ossec...@googlegroups.com
What do you want the agentless support to do? How would agentless
connect to the system to do this?

OSSEC has the capability to look at the syslog messages.

dan (ddp)

unread,
Oct 5, 2012, 12:18:31 PM10/5/12
to ossec...@googlegroups.com
On Fri, Oct 5, 2012 at 12:09 PM, Tom Hangstin <emada...@gmail.com> wrote:
> so i take it the answer is no?
>

Or people are busy. After seeing your comment though I decided to
respond. Apologies for the delay, but I believe all SLAs have been
met.

Adam

unread,
Oct 5, 2012, 12:19:07 PM10/5/12
to ossec...@googlegroups.com
yeah ill just setup my ossec server as a syslog server and have it read the router logs from there.

Michael Barrett

unread,
Oct 5, 2012, 1:00:13 PM10/5/12
to ossec...@googlegroups.com

It seems to be messed up.  The agent ID used to default to the next number, now it seems to be stuck on 1025


____________________________________________
Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation
270 E. Kilbourn Ave. | Milwaukee, WI  53202 USA | ( 1.414.347.6271 | 7 1.888.601.4440 | * michael...@MGIC.com

This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message.

Scott Klauminzer

unread,
Oct 5, 2012, 3:25:40 PM10/5/12
to ossec...@googlegroups.com
Is it possible you have set setmaxagents to 1024 on make?

Scott

On Oct 5, 2012, at 10:00 AM, Michael Barrett <Michael...@mgic.com> wrote:


It seems to be messed up.  The agent ID used to default to the next number, now it seems to be stuck on 1025

<Mail Attachment.gif>

Michael Barrett

unread,
Oct 8, 2012, 11:43:27 AM10/8/12
to ossec...@googlegroups.com, ossec...@googlegroups.com

set to 2048
____________________________________________
Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation
270 E. Kilbourn Ave. | Milwaukee, WI  53202 USA | ( 1.414.347.6271 | 7 1.888.601.4440 | * michael...@MGIC.com

This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message.



From: Scott Klauminzer <sklau...@gmail.com>
To: ossec...@googlegroups.com
Date: 10/05/2012 02:26 PM
Subject: Re: [ossec-list] where does this number come from
Sent by: ossec...@googlegroups.com


sklau...@gmail.com

unread,
Oct 8, 2012, 3:48:40 PM10/8/12
to ossec...@googlegroups.com
And open file max on the Manager system is set to?

Scott 

Michael Barrett

unread,
Oct 10, 2012, 8:59:50 AM10/10/12
to ossec...@googlegroups.com

Anyone have any insight on how to change/resolve this auto number issue?
____________________________________________
Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation
270 E. Kilbourn Ave. | Milwaukee, WI  53202 USA | ( 1.414.347.6271 | 7 1.888.601.4440 | * michael...@MGIC.com

This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message.



From: Scott Klauminzer <sklau...@gmail.com>
To: ossec...@googlegroups.com
Date: 10/05/2012 02:26 PM
Subject: Re: [ossec-list] where does this number come from
Sent by: ossec...@googlegroups.com





dan (ddp)

unread,
Oct 10, 2012, 9:33:02 AM10/10/12
to ossec...@googlegroups.com
On Wed, Oct 10, 2012 at 8:59 AM, Michael Barrett
<Michael...@mgic.com> wrote:
>
>
> Anyone have any insight on how to change/resolve this auto number issue?

I've seen it, but it never bothered me enough to look into. I'd start
in src/addagent.
Reply all
Reply to author
Forward
0 new messages