[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-list
Subject:    Re: [ossec-list] Wazuh OSSEC to external Splunk
From:       Husnain Bustam <habbdt () gmail ! com>
Date:       2019-02-27 16:37:29
Message-ID: CAJN6Qq_FPEbLMuUcDy3x+zkJXeVTH10DPjgBseAv8cX8cO30wg () mail ! gmail ! com
[Download RAW message or body]

Brandon,
Can you please check whether the Splunk user has read access to the
`/var/ossec/logs/alerts/alerts.json`. This was the reason for me why the
data from Wazuh manager to external index was not forwarding. I added spunk
user to the ossec group. After that it started working.
Please let me know if you have any questions. Thanks.


 # ls -l /var/ossec/logs/alerts/alerts.json
-rw-r----- 2 ossec ossec 13661196 Feb 27 11:29
/var/ossec/logs/alerts/alerts.json

# groups splunk
splunk : splunk ossec


On Wed, Feb 27, 2019 at 10:12 AM 'Brandon' via ossec-list <
ossec-list@googlegroups.com> wrote:

> Has anyone successfully gotten Wazuh OSSEC data to an external instance of
> Splunk?  Our Splunk admin is following the guide and we're having issues
> getting the logs to go into it.  The app is configured and it'showing the
> agents in there, but the data is not passing.  They had asked Splunk but
> they were not much help and there was a thread asking for understanding of
> instructions but no answer (
> https://answers.splunk.com/answers/681036/how-to-configure-the-wazuh-app-to-get-data-into-sp.html
>  ).
> 
> Thanks in advance,
> ~Brandon
> 
> --
> 
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+unsubscribe@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
> 

-- 

--- 
You received this message because you are subscribed to the Google Groups \
"ossec-list" group. To unsubscribe from this group and stop receiving emails from it, \
send an email to ossec-list+unsubscribe@googlegroups.com. For more options, visit \
https://groups.google.com/d/optout.


[Attachment #3 (text/html)]

<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Brandon,  <div>Can you \
please check whether the Splunk  user has read access to the \
`/var/ossec/logs/alerts/alerts.json`. This was the reason for me why the data from \
Wazuh manager to external index was not forwarding. I added spunk user to the ossec  \
group. After that it started working.  </div><div>Please let me know if you have any \
questions. Thanks.  </div><div><br></div><div><br></div><div><div>  # ls -l \
/var/ossec/logs/alerts/alerts.json</div><div>-rw-r----- 2 ossec ossec 13661196 Feb 27 \
11:29 /var/ossec/logs/alerts/alerts.json</div><div><br></div><div># groups \
splunk</div><div>splunk : splunk \
ossec</div></div><div><br></div></div></div></div></div><br><div \
class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 27, 2019 at 10:12 \
AM &#39;Brandon&#39; via ossec-list &lt;<a \
href="mailto:ossec-list@googlegroups.com">ossec-list@googlegroups.com</a>&gt; \
wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px \
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Has \
anyone successfully gotten Wazuh OSSEC data to an external instance of Splunk?   Our \
Splunk admin is following the guide and we&#39;re having issues getting the logs to \
go into it.   The app is configured and it&#39;showing the agents in there, but the \
data is not passing.   They had asked Splunk but they were not much help and there \
was a thread asking for understanding of instructions but no answer (<a \
href="https://answers.splunk.com/answers/681036/how-to-configure-the-wazuh-app-to-get-data-into-sp.html" \
target="_blank">https://answers.splunk.com/answers/681036/how-to-configure-the-wazuh-app-to-get-data-into-sp.html</a>).<div><br></div><div>Thanks \
in advance,<br>~Brandon</div></div>

<p></p>

-- <br>
<br>
--- <br>
You received this message because you are subscribed to the Google Groups \
&quot;ossec-list&quot; group.<br> To unsubscribe from this group and stop receiving \
emails from it, send an email to <a \
href="mailto:ossec-list+unsubscribe@googlegroups.com" \
target="_blank">ossec-list+unsubscribe@googlegroups.com</a>.<br> For more options, \
visit <a href="https://groups.google.com/d/optout" \
target="_blank">https://groups.google.com/d/optout</a>.<br> </blockquote></div>

<p></p>

-- <br />
<br />
--- <br />
You received this message because you are subscribed to the Google Groups \
&quot;ossec-list&quot; group.<br /> To unsubscribe from this group and stop receiving \
emails from it, send an email to <a \
href="mailto:ossec-list+unsubscribe@googlegroups.com">ossec-list+unsubscribe@googlegroups.com</a>.<br \
/> For more options, visit <a \
href="https://groups.google.com/d/optout">https://groups.google.com/d/optout</a>.<br \
/>



[prev in list] [next in list] [prev in thread] [next in thread]