Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm very new to OSSEC. I use a server-agent model. I wish to generate alert for the following actions ( in agent side ):

1) Sample Alert for delation of logs

I added the rules for these in agent's ossec.conf using <localfile> tags. Like this :


In my server's ossec.conf. I added the following :


And I restarted my server. Now I tried to delete the agents syslog file using rm syslog. But no alerts has been triggered.

Where I'm making the mistake?

share|improve this question
up vote 1 down vote accepted

localfile is different from syscheck.

Open the /var/ossec/rules/syslog_rules.xml, you will see a bad words list:

<var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted|unresolved|Down</var>

Using logger command to creates an entry in system log:

$ logger connection failed

you can see this message in /var/log/syslog:

Aug 28 17:12:41 ubuntu quanta: connection failed

and get an email with following content:

OSSEC HIDS Notification.
2012 Aug 28 17:12:32

Received From: (Nagios_Slave_6.142)>/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

    Aug 28 17:12:21 ubuntu quanta: connection failed

share|improve this answer
Oh! So I added like this <directories check_all="yes">/var/log</directories> to syscheck(in my agent side). I even did this logger command, which also working. But email is not triggered. I'm using here google's smtp server. Can you show me how you have configured your servers <email> settings? – batman Aug 28 '12 at 10:24
Change the smtp server to and try again. If it doesn't work, change to and take a look at this. – quanta Aug 28 '12 at 10:39
Cool that works. But I have a doubt. I specified the syscheck in my agent side. With the rule <directories check_all="yes">/var/log</directories>. So that means when I do logger connection failed I need to be alerted. But I didn't. I restarted my server, in this case a alert is generated stating that my server is started. But changing the syslog with logger doesn't seemed to be generating an alert. – batman Aug 28 '12 at 10:46
Dont' do that. You probably want to check integrity for only configuration files in /etc. – quanta Aug 28 '12 at 10:49
You're doing wrong. Logs analysis should be place in localfile section, not syscheck (for integrity checking). By default, OSSEC has rules to detect some common actions by analysing important logs. For the particular pattern/action, write your own rule. – quanta Aug 28 '12 at 11:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.