ossec常用命令

1. Ossec启动、停止、重启、状态
/var/ossec/bin/ossec-control {start|stop|restart|status}

2. 启动并查看httpd服务
systemctl start httpd
systemctl status httpd.service

3. 启动并查看mysql服务
systemctl start mariadb
systemctl status mariadb.service

4. 启动并查看sendmail服务
systemctl start sendmail.service
systemctl status sendmail.service

5. 批量重启apache、mysql、sendmail服务
for i in {httpd,mariadb,sendmail};do systemctl restart $i ;done

6. Web界面文件存放目录
/var/www/html/analogi

7. apache应用的虚拟目录
/etc/httpd/conf.d/analogi.conf

8. agent相关配置
/opt/ossec/bin/manage_agents
  (A)dd an agent (A).
  (E)xtract key for an agent (E).
  (L)ist already added agents (L).
  (R)emove an agent (R).
  (Q)uit.

9. 配置/etc/aliases完成将发送到root的邮件转发到其他外部邮件服务器
9.1 安装sendmail
9.2 确认/etc/aliases文件是否存在，如果存在编辑该文件，在末尾添加一条记录
   root： ***@gmail.com
9.3 刷新命令：newaliases
9.4 编辑ossec配置文件/var/ossec/etc/ossec.conf,修改里面的邮件预警等级
   <alerts>
      <log_alert_level>3</log_alert_level>
      <email_alert_level>5</email_alert_level>
  </alerts>

10. OSSEC的规则配置文件默认路径为/var/ossec/rules/

11. /opt/ossec/bin/agent_control -lc　　查看已加入ossec-server，并且处于active状态的主机

12. ossec 预警log的文件目录： /var/ossec/logs/alerts/alerts.log

-----------------------------------
OSSEC日志泛化及告警规则配置：
http://www.freebuf.com/articles/network/36484.html