[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-list
Subject:    Re: [ossec-list] rule test succeeds but fails to alert
From:       "dan (ddp)" <ddpbsd () gmail ! com>
Date:       2014-08-29 18:44:23
Message-ID: CAMyQvMp1FBnNbwNH_qKu=WkxV=Mze0s9iDi9u1R-zcV-ObUiLA () mail ! gmail ! com
[Download RAW message or body]

On Fri, Aug 29, 2014 at 12:16 PM, velvin <velvin@gmail.com> wrote:
> Regardless of the rule ID it triggers, the issue I'm seeing is that while
> manually testing the rule using the ossec-logtest tells me "alert to be
> generated" but in actual testing (causing the event ID from a host with
> agent running) no alerts or log entry is generated (except rule ID 1002). I
> know the workstation is sending the correct log since I see rule ID 1002
> generate the alert but the windows msauth rules are not hit. I am stuck
> here....
> 

Make sure the OSSEC processes restart after you make changes.
Other than that, I cannot reproduce this issue, so I have no clue.

> --
> 
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscribe@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

-- 

--- 
You received this message because you are subscribed to the Google Groups \
"ossec-list" group. To unsubscribe from this group and stop receiving emails from it, \
send an email to ossec-list+unsubscribe@googlegroups.com. For more options, visit \
https://groups.google.com/d/optout.


[prev in list] [next in list] [prev in thread] [next in thread]