store | blogs | forums | twitter | facebook | wiki | downloads | support portal
Atomic Secure Linux
It is currently Tue Sep 30, 2014 11:49 am

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: strange entry from ossec in log
Unread postPosted: Tue Oct 04, 2011 3:15 am 
Offline
Forum Regular
Forum Regular

Joined: Sat Mar 28, 2009 6:58 pm
Posts: 853
Location: Germany
Hi,
what does this error mean?
Thanks

Quote:
OSSEC HIDS Notification.
2011 Oct 04 00:15:38

Received From: server->ossec-keepalive
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

--MARK--: NoX]cly8@xXA^MZ3U^2RW_[QNlpS+W8D!Ayv'fL4CQ/0Kfx?_'Q;wLIref9'2Mw_uVXnic*KTxe.&^,mr]eNGM4;?H*1Bi/VlVqtYblZ#4WWNbqmKuZyo@qo1b^,X$aqD4JJ6dc[7g?2Vp^?K-xYkN#@.epUz3@kC2TQ5d;_Y=?nhw1?m;f!_APz(n)lygw0rxk-^dtHIsU.OpKiWQ);y&rkLSv!Z?E&@.oUO+J-h.Cd1#m5!Nfc@wmrw-]+D$nWs&k65bfvNHyi1;vGFAIled&A't4waz)tjLHxN[S[^&QLrt*Wb7pT!?)ls?I7z9I-2xnXs5?b/.[pqtt5]Jsn-UzXTp#(;o9cLEilehnQfVn9^G=!xj=23qtrF?R@18wghEsZ')j/-wq5kh=I4^e&N@PB!aUF9&'y2Z=W[Oc*!6Q_vI![5%!0Tt]@7/Y;wSq'Zh

--END OF NOTIFICATION


Top
 Profile  
 
 Post subject: Re: strange entry from ossec in log
Unread postPosted: Tue Oct 04, 2011 10:42 am 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3635
Location: Chantilly, VA
That looks like some junk in one of your log files. The MARK is usually something you would see in /var/log/messages. Check that log file.

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: strange entry from ossec in log
Unread postPosted: Tue Oct 04, 2011 2:21 pm 
Offline
Forum Regular
Forum Regular

Joined: Sat Mar 28, 2009 6:58 pm
Posts: 853
Location: Germany
Thanks.
Unfortunately nothing in any log corresponding to that entry.
grep'ed the whole directory /var/log and found nothing.
Should I be concerned? What else could cause this?

Thanks


Top
 Profile  
 
 Post subject: Re: strange entry from ossec in log
Unread postPosted: Tue Oct 04, 2011 3:28 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3635
Location: Chantilly, VA
Are you using OSSEC as a remote syslog server, or are you feeding data into OSSEC from other agents?

And what version of OSSEC are you using?

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: strange entry from ossec in log
Unread postPosted: Tue Oct 04, 2011 3:55 pm 
Offline
Forum Regular
Forum Regular

Joined: Sat Mar 28, 2009 6:58 pm
Posts: 853
Location: Germany
no, just localhost.

Installed Packages
ossec-hids.x86_64 2.6-7.el5.art installed
ossec-hids-server.x86_64 2.6-7.el5.art installed


Top
 Profile  
 
 Post subject: Re: strange entry from ossec in log
Unread postPosted: Tue Oct 04, 2011 6:31 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3635
Location: Chantilly, VA
OK, this is a bug in OSSEC. Its known, and should be fixed in the next major release. You can ignore this.

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: strange entry from ossec in log
Unread postPosted: Wed Oct 05, 2011 3:26 am 
Offline
Forum Regular
Forum Regular

Joined: Sat Mar 28, 2009 6:58 pm
Posts: 853
Location: Germany
Great, thanks for the info.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot], Yahoo [Bot] and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group