We ran into an issue with the test build that is very similar to:

viewtopic.php?f=3&t=4000

The issue appears to have started when we upgraded to the ossec 2.6 rpm.

After looking at the errors generated, we found that we were missing the asl decoder file at:

/var/asl/rules/ossec/etc

Since this is a test box we didn't have another copy of 01-asl-decoder.xml so we used the file from our 2.x ASL install from our other box.

After putting said file in the above folder and in /var/ossec/etc/decoder.d/ we were able to restore OSSEC functionality.

Questions:

Have you had any recent reports of similar issues?

Where can we get the default 01-asl-decoder.xml latest file from so that we aren't running with the 2.0 version (assuming there have been some changes since then)?

Thanks.

I dont really know, so far Ive only seen that happen on cpanel.

Thanks.

Any way you could post a copy of the default 01-asl-decoder.xml file from the test build?

It wouldnt help, its coming from the main decoder.

Scott:

Thanks.

Not sure I'm following. Are you saying that the issue originates from the main decoder file (if so, not quite following why adding the 01-asl file allowed OSSEC to function)?

Yup thats it exactly

Thank you.