Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion.

zcat /var/log/*.gz | /var/ossec/bin/ossec-logtest

Secondly it will automatically run the syscheck and store checksum in /var/ossec/queue/syscheck/ . Is there anything else I need to configure for me to start working with OSSEC ?

share|improve this question

If your system is compromised, you can't trust the OSSEC logs or any other logs generated from that machine. OSSEC is good for detecting new intrusions through log analysis. The command you give is used to detect which OSSEC rule will match the given log. So you are piping all the log files to the ossec-logtest utility and finding out if something matches then you are assuming that the system is already compromised. However, the first step an attack do is to clear all the log entries in order to cover his tracks. That is why OSSEC won't help there.

To your question what steps you need, decide which log files you are going to monitor and add the log file entries in the ossec.conf (or agent.conf) file. If you want to monitor certain files/directories for change, you can do that as well. If you have some custom log files that is not parsed by OSSEC out of the box (you can check it through the ossec-logtest), then write custom decoder in the local_decoder.xml. Don't put your decoder in the decoder.xml file because if you update your agent, it will be lost.

As a last step if you have a centralized log server, then configure the OSSEC manager to forward all the alerts to the central log server by specifying the IP address in the ossec.conf on the manager side.

Edit: For website security, there are some very good posts by Tony Parez:
OSSEC for Website Security Part I
OSSEC - Detecting New Files - Understanding How it Works

share|improve this answer
actually I have a running web server. So in order to increase security I would like to run ossec now. All my logs for httpd are intact. So in this case what should be my next step? I also read it will do a syscheck and build a checksum file right? How about rootkit check? – biz14 Nov 4 '13 at 18:51
If it is an Apache web server, include the access_log and error_log files. If it is at the default location, OSSEC will start monitoring automatically. I have edited the answer and include the links for web site security in the answer. – void_in Nov 4 '13 at 19:29
thank you for the link just to share with you and rest. In centos is kind of difficult to install if you need the yum version. First you can download from this repo the .rpm file Thereafter rebuild it using mock. The only problem here you need to install it as server and no local option available. For instance like AIDE it will build a checksum for all files here how about ossec ? I dont think its similar. – biz14 Nov 5 '13 at 2:09
I have used the RPM version and installed it very easily using the rpm -ivh <pacakge>.rpm. I used the OSSEC client 2.6 version available at It has all the options for local, hybrid, client, and server. – void_in Nov 5 '13 at 5:20
any idea where I can get the latest version of it I mean the 2.7 version ? Because I am using centos 6.4 and you know centos mostly keep the older version of mysql and php due to stability and therefore if I use the version from atomicorp it requires me to install mysql which I dont need. – biz14 Nov 5 '13 at 12:58

Full documentation on the latest version of OSSEC is here:

The documentation is a little light and I found I had to do a lot of trial and error to get it to do exactly what I wanted. My recommendation, especially if you're new to the software, would be to download the Server Virtual Appliance here:

This can be directly imported into VirtualBox and into other VM managers with relative ease. This will give you a running CentOS based GUI with OSSEC and the OSSEC WEB UI already installed for you. If you have questions on your configuration, either specify EXACTLY what you're trying to do here on stack exchange or check out the mailing list specified on that page under "Support Links".

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.