{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/321","repository_url":"https://api.github.com/repos/wazuh/wazuh","labels_url":"https://api.github.com/repos/wazuh/wazuh/issues/321/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh/issues/321/comments","events_url":"https://api.github.com/repos/wazuh/wazuh/issues/321/events","html_url":"https://github.com/wazuh/wazuh/issues/321","id":283373175,"number":321,"title":"3.0.0_2 - Syscheck/Rootcheck scans not happening.","user":{"login":"aslap5","id":34276357,"avatar_url":"https://avatars3.githubusercontent.com/u/34276357?v=4","gravatar_id":"","url":"https://api.github.com/users/aslap5","html_url":"https://github.com/aslap5","followers_url":"https://api.github.com/users/aslap5/followers","following_url":"https://api.github.com/users/aslap5/following{/other_user}","gists_url":"https://api.github.com/users/aslap5/gists{/gist_id}","starred_url":"https://api.github.com/users/aslap5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aslap5/subscriptions","organizations_url":"https://api.github.com/users/aslap5/orgs","repos_url":"https://api.github.com/users/aslap5/repos","events_url":"https://api.github.com/users/aslap5/events{/privacy}","received_events_url":"https://api.github.com/users/aslap5/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-12-19T21:21:11Z","updated_at":"2017-12-22T16:47:51Z","closed_at":null,"author_association":"NONE","body":"I have a lab environment and a test environment both with the same problem.  The syscheck scans only occur when the agent is restarted.  Rootcheck hasn't happened since the agents were installed.\r\n\r\nI believe the issue is with my config file.  I used the same file between the two.  Right now I have the scan frequency set to 60 seconds to test if it's working.  I've included the last few lines of the ossec.log file as well as the config file.\r\n\r\nLog was pulled 10 minutes after the last message.  It should have scanned in that period.\r\n`2017/12/19 14:53:02 ossec-logcollector: WARNING: Duplicated log file given: '/var/ossec/logs/active-responses.log'.\r\n2017/12/19 14:53:02 ossec-logcollector: WARNING: Duplicated log file given: '/var/log/auth.log'.\r\n2017/12/19 14:53:02 ossec-logcollector: WARNING: Duplicated log file given: '/var/log/syslog'.\r\n2017/12/19 14:53:02 ossec-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.\r\n2017/12/19 14:53:02 ossec-logcollector: INFO: (1950): Analyzing file: '/var/log/kern.log'.\r\n2017/12/19 14:53:02 ossec-logcollector: INFO: Started (pid: 2748).\r\n2017/12/19 14:53:32 ossec-syscheckd: INFO: Syscheck scan frequency: 60 seconds\r\n2017/12/19 14:54:02 ossec-syscheckd: INFO: Starting syscheck scan (forwarding database).\r\n2017/12/19 14:54:02 ossec-syscheckd: INFO: Starting syscheck database (pre-scan).\r\n2017/12/19 14:55:12 ossec-logcollector: INFO: (1904): File not available, ignoring it: '/var/log/messages'.\r\n`\r\n\r\nAgent.conf and ossec.conf from the agent are in reply messages."},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/comments/353635006","html_url":"https://github.com/wazuh/wazuh/issues/321#issuecomment-353635006","issue_url":"https://api.github.com/repos/wazuh/wazuh/issues/321","id":353635006,"user":{"login":"aslap5","id":34276357,"avatar_url":"https://avatars3.githubusercontent.com/u/34276357?v=4","gravatar_id":"","url":"https://api.github.com/users/aslap5","html_url":"https://github.com/aslap5","followers_url":"https://api.github.com/users/aslap5/followers","following_url":"https://api.github.com/users/aslap5/following{/other_user}","gists_url":"https://api.github.com/users/aslap5/gists{/gist_id}","starred_url":"https://api.github.com/users/aslap5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aslap5/subscriptions","organizations_url":"https://api.github.com/users/aslap5/orgs","repos_url":"https://api.github.com/users/aslap5/repos","events_url":"https://api.github.com/users/aslap5/events{/privacy}","received_events_url":"https://api.github.com/users/aslap5/received_events","type":"User","site_admin":false},"created_at":"2017-12-22T16:47:51Z","updated_at":"2017-12-22T16:47:51Z","author_association":"NONE","body":"Everything looks to be working correctly now.  Thanks for the help.\r\n\r\nI have 1 last question regarding syscheck.  Specifically around rules and how they are triggered.  PCI requires alerts generated on log file size reduced.  There's already a rule in wazuh for that but what triggers it?  Is it <syscheck> or <localfile> that generates that alert?"}}
{"actor":{"display_login":"aslap5"}}