Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion.

zcat /var/log/*.gz | /var/ossec/bin/ossec-logtest

Secondly it will automatically run the syscheck and store checksum in /var/ossec/queue/syscheck/ . Is there anything else I need to configure for me to start working with OSSEC ?

share|improve this question

1 Answer 1

If your system is compromised, you can't trust the OSSEC logs or any other logs generated from that machine. OSSEC is good for detecting new intrusions through log analysis. The command you give is used to detect which OSSEC rule will match the given log. So you are piping all the log files to the ossec-logtest utility and finding out if something matches then you are assuming that the system is already compromised. However, the first step an attack do is to clear all the log entries in order to cover his tracks. That is why OSSEC won't help there.

To your question what steps you need, decide which log files you are going to monitor and add the log file entries in the ossec.conf (or agent.conf) file. If you want to monitor certain files/directories for change, you can do that as well. If you have some custom log files that is not parsed by OSSEC out of the box (you can check it through the ossec-logtest), then write custom decoder in the local_decoder.xml. Don't put your decoder in the decoder.xml file because if you update your agent, it will be lost.

As a last step if you have a centralized log server, then configure the OSSEC manager to forward all the alerts to the central log server by specifying the IP address in the ossec.conf on the manager side.

Edit: For website security, there are some very good posts by Tony Parez:
OSSEC for Website Security Part I
OSSEC - Detecting New Files - Understanding How it Works

share|improve this answer
actually I have a running web server. So in order to increase security I would like to run ossec now. All my logs for httpd are intact. So in this case what should be my next step? I also read it will do a syscheck and build a checksum file right? How about rootkit check? –  biz14 Nov 4 '13 at 18:51
If it is an Apache web server, include the access_log and error_log files. If it is at the default location, OSSEC will start monitoring automatically. I have edited the answer and include the links for web site security in the answer. –  void_in Nov 4 '13 at 19:29
thank you for the link just to share with you and rest. In centos is kind of difficult to install if you need the yum version. First you can download from this repo the .rpm file atomicorp.com/channels/source/ossec-hids. Thereafter rebuild it using mock. The only problem here you need to install it as server and no local option available. For instance like AIDE it will build a checksum for all files here how about ossec ? I dont think its similar. –  biz14 Nov 5 '13 at 2:09
I have used the RPM version and installed it very easily using the rpm -ivh <pacakge>.rpm. I used the OSSEC client 2.6 version available at rpm-find.net/linux/rpm2html/search.php?query=ossec-hids-client. It has all the options for local, hybrid, client, and server. –  void_in Nov 5 '13 at 5:20
any idea where I can get the latest version of it I mean the 2.7 version ? Because I am using centos 6.4 and you know centos mostly keep the older version of mysql and php due to stability and therefore if I use the version from atomicorp it requires me to install mysql which I dont need. –  biz14 Nov 5 '13 at 12:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.