ossec server syslog output

[Olivier Doisneau]

So I changed my ossec.conf to have this:

  <syslog_output>

    <server>127.0.0.1</server>

    <port>8089</port>

    <format>default</format>

  </syslog_output>

and /var/ossec/bin/ossec-csyslogd 

is started.  But I don't see any attempts to push the logs coming in to syslog in the ossec.log file.

Thanks

[dan (ddp)]

The ossec.log doesn't usually contain logs that it's logging. You
should be able to see the alerts via tcpdump on the ossec manager:
`tcpdump -nn port 8089`

>
> Thanks
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Olivier Doisneau]

So every time I see a log in the /var/ossec/log/alerts/alerts.log I should see something being dumped correct?  Because right now I see alerts.log getting bigger and still nothing on tcpdump.

[dan (ddp)]

On Thu, Sep 1, 2016 at 10:49 AM, Olivier Doisneau
<odoi...@payveris.com> wrote:
> So every time I see a log in the /var/ossec/log/alerts/alerts.log I should
> see something being dumped correct? Because right now I see alerts.log
> getting bigger and still nothing on tcpdump.
>

Yes, you should. Try running csyslogd in debug/foreground mode to see
if there are any interesting logs:
`/var/ossec/bin/ossec-csyslogd -df`

>
> On Thursday, September 1, 2016 at 10:18:07 AM UTC-4, Olivier Doisneau wrote:
>>
>> So I changed my ossec.conf to have this:
>>
>> <syslog_output>
>>
>> <server>127.0.0.1</server>
>>
>> <port>8089</port>
>>
>> <format>default</format>
>>
>> </syslog_output>
>>
>>
>> and /var/ossec/bin/ossec-csyslogd
>>
>> is started. But I don't see any attempts to push the logs coming in to
>> syslog in the ossec.log file.
>>
>>
>> Thanks
>

[Olivier Doisneau]

yes so this is what I see in the alerts.log

** Alert 1472743613.1120105: - pam,syslog,

2016 Sep 01 15:26:53 (dev-login-01) any->/var/log/secure

Rule: 5502 (level 3) -> 'Login session closed.'

Sep  1 15:26:51 dev-login-01 sshd[2930]: pam_unix(sshd:session): session closed for user od

but nothing for the process except this:

2016/09/01 15:24:06 ossec-csyslogd: DEBUG: Starting ...

2016/09/01 15:24:06 ossec-csyslogd: INFO: Chrooted to directory: /var/ossec, using user: ossecm

2016/09/01 15:24:06 ossec-csyslogd: INFO: Started (pid: 12106).

2016/09/01 15:24:06 ossec-csyslogd: INFO: File queue connected.

2016/09/01 15:24:06 ossec-csyslogd: INFO: Forwarding alerts via syslog to: '127.0.0.1:8089'.

and nothing else...

On Thursday, September 1, 2016 at 10:18:07 AM UTC-4, Olivier Doisneau wrote:

[dan (ddp)]

On Thu, Sep 1, 2016 at 11:07 AM, dan (ddp) <ddp...@gmail.com> wrote:
> On Thu, Sep 1, 2016 at 10:49 AM, Olivier Doisneau
> <odoi...@payveris.com> wrote:
>> So every time I see a log in the /var/ossec/log/alerts/alerts.log I should
>> see something being dumped correct? Because right now I see alerts.log
>> getting bigger and still nothing on tcpdump.
>>
>
> Yes, you should. Try running csyslogd in debug/foreground mode to see
> if there are any interesting logs:
> `/var/ossec/bin/ossec-csyslogd -df`
>

You might want to also try setting <level>1</level> in the
syslog_output section.

[dan (ddp)]

On Thu, Sep 1, 2016 at 11:27 AM, Olivier Doisneau
<odoi...@payveris.com> wrote:
> yes so this is what I see in the alerts.log
>
> ** Alert 1472743613.1120105: - pam,syslog,
>
> 2016 Sep 01 15:26:53 (dev-login-01) any->/var/log/secure
>
> Rule: 5502 (level 3) -> 'Login session closed.'
>
> Sep 1 15:26:51 dev-login-01 sshd[2930]: pam_unix(sshd:session): session
> closed for user od
>
>
> but nothing for the process except this:
>
>
> 2016/09/01 15:24:06 ossec-csyslogd: DEBUG: Starting ...
>
> 2016/09/01 15:24:06 ossec-csyslogd: INFO: Chrooted to directory: /var/ossec,
> using user: ossecm
>
> 2016/09/01 15:24:06 ossec-csyslogd: INFO: Started (pid: 12106).
>
> 2016/09/01 15:24:06 ossec-csyslogd: INFO: File queue connected.
>
> 2016/09/01 15:24:06 ossec-csyslogd: INFO: Forwarding alerts via syslog to:
> '127.0.0.1:8089'.
>

I didn't realize this was on loopback (not that it matters
apparently). This works for me:
<syslog_output>
<server>127.0.0.1</server>
<port>9514</port>
</syslog_output>


Make sure your syslog daemon is listening on localhost udp/8089, and
it's configured to accept the messages.

>
> and nothing else...
>
>
> On Thursday, September 1, 2016 at 10:18:07 AM UTC-4, Olivier Doisneau wrote:
>>
>> So I changed my ossec.conf to have this:
>>
>> <syslog_output>
>>
>> <server>127.0.0.1</server>
>>
>> <port>8089</port>
>>
>> <format>default</format>
>>
>> </syslog_output>
>>
>>
>> and /var/ossec/bin/ossec-csyslogd
>>
>> is started. But I don't see any attempts to push the logs coming in to
>> syslog in the ossec.log file.
>>
>>
>> Thanks
>

[Olivier Doisneau]

I am all set.  It was the forwarder that was mis-configured.

On Thursday, September 1, 2016 at 10:18:07 AM UTC-4, Olivier Doisneau wrote: