search

jrossi / issue-migration-test

GNU General Public License v2.0
1 stars 0 forks source link

[2.7-syscheck-Linux] report_changes=yes not reporting diffs in alerts (AIX was OK) #33

Open jrossi opened 10 years ago

jrossi commented 10 years ago
/etc Diff showed up under queue/diff/. But not included in alerts.log -- reported by mcrane0 on ossec-list 11/13/2012 **Note**: This issue has been automatically migrated from Bitbucket Created by [jbcheng](https://bitbucket.org/jbcheng) on 2012-12-04 19:09:18+00:00, last updated: 2013-11-26 02:57:14+00:00
jrossi commented 10 years ago

I've done a fair amount of test of realtime's check and still get odds behaviours. Seems like Gael's patch (issue #57 - pull-request/19) is helping but does not solve the inconsistencies.

So far I'm having difficultiesas it seems pretty random: sometimes an alert gets sent the second I add or modify a file and sometime nothing (same or different files). I'll try to dig deeper but really there's something not right.

I'm currently investigating on a fresh version of Ubuntu server 12.04 since I realized sometime wasn't right on my implement of realtime for *BSD. Now I know it's not local to my BSD implementation but really in OSSEC's realtime code.

Note: This comment has been automatically migrated from Bitbucket Created by northox on 2013-11-25 03:41:09+00:00

jrossi commented 10 years ago

Danny, check to make sure you're not dropping UDP packets due to a full buffer. On Linux, it's netstat -s. I was helping another user recently who had this problem and I also noticed it on my server, which only gets about 2 million events per day.

Note: This comment has been automatically migrated from Bitbucket Created by mstarks01 on 2013-11-25 03:52:34+00:00

jrossi commented 10 years ago

No that's not it. I can see other actions of the remote agent on OSSEC's server as they happen, just not the realtime filesystem checks.

I'll add this to my test: trigger a standard alert then play with a realtime directory and finally another standard alert.

Note: This comment has been automatically migrated from Bitbucket Created by northox on 2013-11-26 02:57:14+00:00, last updated: 2013-11-26 03:00:42+00:00