This includes a number of new features, including agentless monitoring, C type regular expression engine, and fixes to the mysql back end management system. Test builds are not supported, but we do appreciate the bug reports. Standard disclaimers apply - do not run on production systems, etc.

This announcement is primarily focused at people using mysql to store events, and have been experiencing unstable ossec-dbd processes. These will manifest as PSMON restart events.

Upgrading to 2.0.0-0.090205 can be accomplished with:

Step 1) Upgrade packages
yum --enablerepo=asl-2.0-testing upgrade ossec-hids


Step 2) Update the configuration
asl -m ossec_check.sh -f

Step 3) (Optional) Confirm that firewall rules allow mysql connections over 3306 from localhost
iptables -I INPUT -s localhost -d localhost -p 3306 -j ACCEPT

Thx! Scott hope this will be in release soon!

A followup here, the 2 conditions to verify are related to what happens when mysql is restarted:

1) ossec-dbd not dying

2) events continue to be collected in mysql after the restart

This appears to have worked, although I have seen a couple of restarts overnight after the latest version is updated. If I find anything worth reporting I will relay the info

Think you could check the logs (or just send them to me) for when/what happened?

do you want info only on ossec-dbd ?

yeah just that for now, although if you run into any other issues we can pass them on to the OSSEC team. I know they're really interested in the agentless monitoring stuff