search

ossec / ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
http://www.ossec.net
Other
4.42k stars 1.03k forks source link

jessie systemd start\stop script #684

Closed dmitrijn closed 5 years ago

dmitrijn commented 8 years ago

hello,

getting trouble with systemd start\stop script for ossec-hids-agent installed from ossec.wazuh repo. 2.8.2 with init.d script working fine, but upgrading to version 2.8.3 the systemd service start fails

os: debian jessie 8.2

Nov  9 10:23:39 localhost systemd[1]: Starting OSSEC service...
Nov  9 10:23:39 localhost systemd[1]: Started OSSEC service.
Nov  9 10:23:39 localhost env[1315]: Starting OSSEC HIDS v2.8.3 (by Trend Micro Inc.)...
Nov  9 10:23:39 localhost env[1315]: 2015/11/09 10:23:39 ossec-execd: INFO: Adding offenders timeout: 30 (for #1)
Nov  9 10:23:39 localhost env[1315]: 2015/11/09 10:23:39 ossec-execd: INFO: Adding offenders timeout: 60 (for #2)
Nov  9 10:23:39 localhost env[1315]: 2015/11/09 10:23:39 ossec-execd: INFO: Adding offenders timeout: 120 (for #3)
Nov  9 10:23:39 localhost env[1315]: 2015/11/09 10:23:39 ossec-execd: INFO: Adding offenders timeout: 600 (for #4)
Nov  9 10:23:39 localhost env[1315]: 2015/11/09 10:23:39 ossec-execd: INFO: Adding offenders timeout: 1440 (for #5)
Nov  9 10:23:39 localhost env[1315]: Started ossec-execd...
Nov  9 10:23:39 localhost env[1315]: 2015/11/09 10:23:39 ossec-agentd: INFO: Using notify time: 600 and max time to reconnect: 1800
Nov  9 10:23:39 localhost env[1315]: Started ossec-agentd...
Nov  9 10:23:39 localhost env[1315]: Started ossec-logcollector...
Nov  9 10:23:39 localhost env[1315]: Started ossec-syscheckd...
Nov  9 10:23:41 localhost env[1315]: Completed.
Nov  9 10:23:42 localhost env[1346]: Killing ossec-logcollector ..
Nov  9 10:23:42 localhost env[1346]: ossec-syscheckd not running ..
Nov  9 10:23:42 localhost env[1346]: Killing ossec-agentd ..
Nov  9 10:23:42 localhost env[1346]: Killing ossec-execd ..
Nov  9 10:23:42 localhost env[1346]: OSSEC HIDS v2.8.3 Stopped
root@localhost:/etc/systemd/system# systemctl status ossec.service
● ossec.service - OSSEC service
   Loaded: loaded (/lib/systemd/system/ossec.service; linked)
   Active: inactive (dead)

Nov 09 09:14:43 localhost env[30293]: Started ossec-agentd...
Nov 09 09:14:43 localhost env[30293]: Started ossec-logcollector...
Nov 09 09:14:43 localhost env[30293]: Started ossec-syscheckd...
Nov 09 09:14:45 localhost env[30293]: Completed.
Nov 09 09:14:45 localhostenv[30326]: Killing ossec-logcollector ..
Nov 09 09:14:45localhost env[30326]: ossec-syscheckd not running ..
Nov 09 09:14:45 localhost env[30326]: Killing ossec-agentd ..
Nov 09 09:14:45 localhost env[30326]: Killing ossec-execd ..
Nov 09 09:14:45 localhost env[30326]: OSSEC HIDS v2.8.3 Stopped
Nov 09 09:42:36 localhost systemd[1]: Stopped OSSEC service.
awiddersheim commented 8 years ago

@santiago-bassett can you take a look?

hregis commented 8 years ago

@santiago-bassett i have the same problem

santiago-bassett commented 8 years ago

Thanks for letting me know, will fix this asap

santiago-bassett commented 8 years ago

Should be fixed now. Debian packages new version is 2.8.3-3

dmitrijn commented 8 years ago

@santiago-bassett, thank you, now init.d script working fine with new version.

can you make that internal_options.conf don't rewrite it every package update? it would be good to have diff option to approve or decline update of this file. i have modification like maild.groupping=0 maild.full_subject=1

santiago-bassett commented 8 years ago

makes senses. Will add this to the next release. Thanks for the feedback.

On Fri, Nov 13, 2015 at 1:37 AM, dmitrijn notifications@github.com wrote:

@santiago-bassett https://github.com/santiago-bassett, thank you, now init.d script working fine with new version.

can you make that internal_options.conf don't rewrite it every package update? it would be good to have diff option to approve or decline update of this file. i have modification like maild.groupping=0 maild.full_subject=1

— Reply to this email directly or view it on GitHub https://github.com/ossec/ossec-hids/issues/684#issuecomment-156377921.