Hello,
After upgrading ossec-hids i got a problem with ossec:
Code:
2012/06/26 13:08:06 ossec-dbd: Connected to database 'tortix' at '127.0.0.1'.
2012/06/26 13:08:06 ossec-dbd: Unable to insert location: 'xxxx->netstat -nltp | grep LISTEN | egrep -v "127.0.0.1|\[1-9][1-9][1-9][1-9].*ftp" | awk '{print $1"\t"$4"\t"$5"\t"$6}''.
2012/06/26 13:08:11 ossec-dbd(5203): ERROR: Error executing query 'SELECT id FROM location WHERE name = 'xxxxx->netstat -nltp | grep LISTEN | egrep -v "127.0.0.1|\[1-9][1-9][1-9][1-9].*ftp" | awk '{print $1"\t"$4"\t"$5"\t"$6}'' AND server_id = '2' LIMIT 1'. Error: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '{print $1"\t"$4"\t"$5"\t"$6}'' AND server_id = '2' LIMIT 1' at line 1'.
2012/06/26 13:08:11 ossec-dbd(5209): INFO: Closing connection to database.
2012/06/26 13:08:11 ossec-dbd(5210): INFO: Attempting to reconnect to database.
2012/06/26 13:08:11 ossec-dbd: Connected to database 'tortix' at '127.0.0.1'.
2012/06/26 13:08:11 ossec-dbd(5203): ERROR: Error executing query 'INSERT INTO location(server_id, name) VALUES ('2', 'xxxxxx->netstat -nltp | grep LISTEN | egrep -v "127.0.0.1|\[1-9][1-9][1-9][1-9].*ftp" | awk '{print $1"\t"$4"\t"$5"\t"$6}'')'. Error: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '{print $1"\t"$4"\t"$5"\t"$6}'')' at line 1'.
2012/06/26 13:08:11 ossec-dbd(5209): INFO: Closing connection to database.
2012/06/26 13:08:11 ossec-dbd(5210): INFO: Attempting to reconnect to database.
2012/06/26 13:08:11 ossec-dbd: Connected to database 'tortix' at '127.0.0.1'.
2012/06/26 13:08:11 ossec-dbd(5204): ERROR: Database error. Unable to run query.
2012/06/26 13:08:11 ossec-dbd(5203): ERROR: Error executing query 'SELECT id FROM location WHERE name = 'xxxxx->netstat -nltp | grep LISTEN | egrep -v "127.0.0.1|\[1-9][1-9][1-9][1-9].*ftp" | awk '{print $1"\t"$4"\t"$5"\t"$6}'' AND server_id = '2' LIMIT 1'. Error: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '{print $1"\t"$4"\t"$5"\t"$6}'' AND server_id = '2' LIMIT 1' at line 1'.
2012/06/26 13:08:11 ossec-dbd(5208): ERROR: Multiple database errors. Exiting.
2012/06/26 13:08:46 ossec-monitord(1225): INFO: SIGNAL Received. Exit Cleaning...
2012/06/26 13:08:46 ossec-logcollector(1225): INFO: SIGNAL Received. Exit Cleaning...
2012/06/26 13:08:47 ossec-syscheckd(1225): INFO: SIGNAL Received. Exit Cleaning...
2012/06/26 13:08:47 ossec-analysisd(1225): INFO: SIGNAL Received. Exit Cleaning...
2012/06/26 13:08:47 ossec-execd(1314): INFO: Shutdown received. Deleting responses.
2012/06/26 13:08:47 ossec-execd(1225): INFO: SIGNAL Received. Exit Cleaning...
2012/06/26 13:08:57 ossec-dbd: Connected to database 'tortix' at '127.0.0.1'.
2012/06/26 13:08:57 ossec-maild: INFO: E-Mail notification disabled. Clean Exit.
2012/06/26 13:08:57 ossec-execd: INFO: Adding offenders timeout: 20 (for #1)
2012/06/26 13:08:57 ossec-execd: INFO: Adding offenders timeout: 40 (for #2)
2012/06/26 13:08:57 ossec-execd: INFO: Adding offenders timeout: 80 (for #3)
2012/06/26 13:08:57 ossec-execd: INFO: Started (pid: 1343).
somebody know what happening?
ossec version is ossec-hids-2.6-14.el5.art
asl version ASL Version 3.0.26: CentOS 5 (SUPPORTED)
asl -s -f didn't help
thanx in advanced