1

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is that 10108 is no longer being listened on, and previous output doesn't show most of my services that should be listening at any given time..

But I feel like I am not reading this properly. I want to be clear on how to identify what has changed exactly so that I might have some scope into researching this.

Received From: domainname->netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort
Rule: 533 fired (level 7) -> "Listened ports status (netstat) changed (new port opened or closed)."
Portion of the log(s):


ossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort':
    tcp        0      0 0.0.0.0:922                0.0.0.0:*                  LISTEN      
    tcp        0      0 :::106                      :::*                        LISTEN      
    tcp        0      0 :::110                      :::*                        LISTEN      
    tcp        0      0 :::143                      :::*                        LISTEN      
    tcp        0      0 :::21                      :::*                        LISTEN      
    tcp        0      0 :::25                      :::*                        LISTEN      
    tcp        0      0 :::465                      :::*                        LISTEN      
    tcp        0      0 *.*.*.*:443            0.0.0.0:*                  LISTEN      
    tcp        0      0 *.*.*.*:80            0.0.0.0:*                  LISTEN      
    tcp        0      0 :::7080                    :::*                        LISTEN      
    tcp        0      0 :::7081                    :::*                        LISTEN      
    tcp        0      0 :::8443                    :::*                        LISTEN      
    tcp        0      0 :::8880                    :::*                        LISTEN      
    tcp        0      0 :::922  
    Previous output:
    ossec: output: 'netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort':
    tcp        0      0 0.0.0.0:10108              0.0.0.0:*                  LISTEN      
    tcp        0      0 0.0.0.0:922                0.0.0.0:*                  LISTEN      
    tcp        0      0 :::106                      :::*                        LISTEN      
4
  • You have it correct, assuming that you didn't cut off the output to post here.
    – schroeder
    Sep 15, 2014 at 16:27
  • Yeah I haven't cut anything off. I wasn't sure if OSSEC only output the ports that changed in the previous output and all of the ports in the current output... Although I'm confused as to what would necessarily cause this. Specifically I could understand if my apache ports went down if apache restarted itself somehow. But it's a lot of services, FTP, Apache, Nginx and others that stop listening, which is why I feel like I'm reading things wrong or misunderstanding something.
    – codewizard
    Sep 15, 2014 at 16:33
  • Ah it actually looks like this was due to logrotate.
    – codewizard
    Sep 15, 2014 at 16:48
  • Hi - I realise you posted this a while ago, but I am hitting the same problem and wondered if you could indicate what log the rotation was occuring on (and on which agent or server-side) - and if this can be fixed? From what I can see this is an OSSEC level command in ossec.conf and I don't see this level of output in ossec.log file
    – Dazed
    Nov 29, 2017 at 13:30

2 Answers 2

1

Your interpretation of the results are correct. You aren't missing anything.

From your subsequent comments, the reason why there is less data is due to a log rotate issue cleaning up old data, which makes sense.

This event means that you need to keep this context in mind and have a way to validate what logs are being alerted on and how complete those logs are.

0
2

For what it is worth, and for others arriving at this page looking for an answer, I've been seeing similar behaviour. I've been getting regular, and frankly irritating, Level 7 notifications from OSSEC about rule 533.

I think it is being triggered because of the runlevel where OSSEC is starting and establishing the current list of listening ports, takes place before most of the services that will be listening on 127.0.0.1 have started.

To get around this, I have moved ossec from K20ossed to K98ossec in /etc/rc0.d. IT seems to have stopped the alerts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .