strange entry from ossec in log

BruceLee · **Posted:** Tue Oct 04, 2011 3:15 am

Hi,
what does this error mean?
Thanks

Quote:

OSSEC HIDS Notification.
2011 Oct 04 00:15:38

Received From: server->ossec-keepalive
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

--MARK--: NoX]cly8@xXA^MZ3U^2RW_[QNlpS+W8D!Ayv'fL4CQ/0Kfx?_'Q;wLIref9'2Mw_uVXnic*KTxe.&^,mr]eNGM4;?H*1Bi/VlVqtYblZ#4WWNbqmKuZyo@qo1b^,X$aqD4JJ6dc[7g?2Vp^?K-xYkN#@.epUz3@kC2TQ5d;_Y=?nhw1?m;f!_APz(n)lygw0rxk-^dtHIsU.OpKiWQ);y&rkLSv!Z?E&@.oUO+J-h.Cd1#m5!Nfc@wmrw-]+D$nWs&k65bfvNHyi1;vGFAIled&A't4waz)tjLHxN[S[^&QLrt*Wb7pT!?)ls?I7z9I-2xnXs5?b/.[pqtt5]Jsn-UzXTp#(;o9cLEilehnQfVn9^G=!xj=23qtrF?R@18wghEsZ')j/-wq5kh=I4^e&N@PB!aUF9&'y2Z=W[Oc*!6Q_vI![5%!0Tt]@7/Y;wSq'Zh

--END OF NOTIFICATION

mikeshinn · **Posted:** Tue Oct 04, 2011 10:42 am

That looks like some junk in one of your log files. The MARK is usually something you would see in /var/log/messages. Check that log file.

BruceLee · **Posted:** Tue Oct 04, 2011 2:21 pm

Thanks.
Unfortunately nothing in any log corresponding to that entry.
grep'ed the whole directory /var/log and found nothing.
Should I be concerned? What else could cause this?

Thanks

mikeshinn · **Posted:** Tue Oct 04, 2011 3:28 pm

Are you using OSSEC as a remote syslog server, or are you feeding data into OSSEC from other agents?

And what version of OSSEC are you using?

BruceLee · **Posted:** Tue Oct 04, 2011 3:55 pm

no, just localhost.

Installed Packages
ossec-hids.x86_64 2.6-7.el5.art installed
ossec-hids-server.x86_64 2.6-7.el5.art installed

mikeshinn · **Posted:** Tue Oct 04, 2011 6:31 pm

OK, this is a bug in OSSEC. Its known, and should be fixed in the next major release. You can ignore this.

BruceLee · **Posted:** Wed Oct 05, 2011 3:26 am

Great, thanks for the info.

strange entry from ossec in log

Who is online