0

I have just installed OSSec accordingly as the server. When it asked for my email I put in my GMail address and for the SMTP I was not sure so I just set it as localhost first. Then it runs a number of commands accordingly. Finally it states this:

In order to connect agent and server, you need to add each agent to the server.
   Run the 'manage_agents' to add or remove them:

   /var/ossec/bin/manage_agents

Another thing I did this /var/ossec/bin/ossec-control start

Starting OSSEC HIDS v2.6 (by Trend Micro Inc.)...
OSSEC analysisd: Testing rules failed. Configuration error. Exiting.
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-remoted...
Started ossec-syscheckd...

Part of config file.

  <global>
    <email_notification>yes</email_notification>
    <email_to>*****@gmail.com</email_to>
    <smtp_server>localhost</smtp_server>
    <email_from>ossecm@localhost.localdomain</email_from>
  </global>

Started ossec-monitord...
Completed.

So what error is it telling me about the configuration?

slm
  • 7,355
  • 16
  • 54
  • 72
new14
  • 187
  • 3
  • 9

1 Answers1

2

You made a mistake in your configuration, probably the way you entered your smtp or email address. Check your config here /var/ossec/etc/ossec.conf (add it to your question). It should look somewhat like this:

 <smtp_server>localhost</smtp_server>
 <email_to>example@example.com</email_to>

The first rule is to tell you you can add agents (other servers running ossec reporting to this central server). This means you probably installed OSSEC was installed as server. If this is your only machine you are better off installing as standalone. I posted a guide on my blog for OSSEC which explains some of the basics.

Lucas Kauffman
  • 16,818
  • 9
  • 57
  • 92
  • I have addded my quesstion with part of the ossec.conf file. Yes when it as me to to install as server manager or agent I installed as server so what is wrong here? How can I undo this now? – new14 Dec 30 '12 at 10:49
  • I did this ln s /var/ossec/bin/osseclogtest /var/ossec/ossec-logtest and the error is gone. So how to verify is everything is working I also did this /var/ossec/bin/ossec-contro enable agentless is this correct? – new14 Dec 31 '12 at 04:56