I have just installed the current stable release of OSSEC (2.8.1) for Ubuntu, but at the end of the installation I noticed that it said:
- System is Debian (Ubuntu or derivative). - Init script modified to start OSSEC HIDS during boot. - Configuration finished properly. - To start OSSEC HIDS: /var/ossec/bin/ossec-control start - To stop OSSEC HIDS: /var/ossec/bin/ossec-control stop - The configuration can be viewed or modified at /var/ossec/etc/ossec.conf
So what is
OSSEC HIDS, is it the actual program or something else? If it is the actual program then does this mean that I need to add the command
/var/ossec/bin/ossec-control start to the list of startup applications?
I have found that unless I run this command to manually start OSSEC HIDS:
sudo /var/ossec/bin/ossec-control start
That if I run the command to check the status:
sudo /var/ossec/bin/ossec-control status
This is the output:
ossec-monitord not running... ossec-logcollector not running... ossec-syscheckd not running... ossec-analysisd not running... ossec-maild not running... ossec-execd not running...
So it does not seem that it starts automatically, how can I get it to do this then? I have also found that I cannot add this to the list of startup applications as the start command requires
sudo to be executed.
Description: Ubuntu 14.10 Release: 14.10