no log on event.dataset:ossec

[Bikesh-Yadav]

I am running SO as managersearch. Ossec was running while installing but suddenly log stops for ossec dataset. Even alert stops for ossec logs.

OUTPUTS:

1. tail -f /nsm/wazuh/logs/ossec.log

2023/05/24 14:16:57 ossec-csyslogd: CRITICAL: (1226): Error reading XML file '/var/ossec/etc/ossec.conf': (line 0).
2023/05/24 14:16:57 ossec-authd: CRITICAL: (1226): Error reading XML file '/var/ossec/etc/ossec.conf': (line 0).
2023/05/28 04:06:25 ossec-csyslogd: CRITICAL: (1226): Error reading XML file '/var/ossec/etc/ossec.conf': (line 0).
2023/05/28 04:06:25 ossec-authd: CRITICAL: (1226): Error reading XML file '/var/ossec/etc/ossec.conf': (line 0).
2023/05/28 04:13:16 manage_agents: CRITICAL: (1226): Error reading XML file '/var/ossec/etc/ossec.conf': (line 0).
2023/05/28 04:23:42 ossec-csyslogd: CRITICAL: (1226): Error reading XML file '/var/ossec/etc/ossec.conf': (line 0).
2023/05/28 04:23:42 ossec-authd: CRITICAL: (1226): Error reading XML file '/var/ossec/etc/ossec.conf': (line 0).

What will be the possible soutions?

[dougburks]

Have you made any changes to the Wazuh (OSSEC) configuration?

What is the output of the following?

ls -alh /nsm/wazuh/etc/

[Bikesh-Yadav]

No, i haven't done any changes to wazuh, it suddenly stops working.

OUTPUT:

ls -alh /nsm/wazuh/etc/

drwxrwx--- 7 ossec ossec 303 May 30 06:03 .
drwxrwxr-x 9 ossec ossec 112 May 30 06:03 ..
-rw-rw---- 1 ossec ossec 90 May 30 06:03 client.keys
drwxrwx--- 2 ossec ossec 31 May 15 16:11 decoders
-rw-rw-r-- 1 root root 55 May 30 06:03 initial_agent_registration.log
-rw-rw---- 1 ossec ossec 14K Jul 13 2020 internal_options.conf
drwxrwx--- 3 ossec ossec 122 May 15 16:11 lists
-rw-rw---- 1 ossec ossec 320 Jul 13 2020 local_internal_options.conf
-rw-rw---- 1 ossec ossec 118 Jul 13 2020 localtime
-rw-rw-r-- 1 ossec ossec 6.5K May 30 06:12 ossec.conf
lrwxrwxrwx 1 ossec ossec 20 Jul 13 2020 ossec-init.conf -> /etc/ossec-init.conf
drwxrwx--- 2 ossec ossec 4.0K May 15 16:11 rootcheck
drwxrwx--- 2 ossec ossec 29 May 15 16:11 rules
drwxrwx--- 3 ossec ossec 4.0K May 30 06:03 shared
-rw-rw---- 1 ossec ossec 1.2K May 15 16:12 sslmanager.cert
-rw-rw---- 1 ossec ossec 1.7K May 15 16:12 sslmanager.key

[dougburks]

Are you sure that no changes were made to ossec.conf on May 30?

-rw-rw-r-- 1 ossec ossec 6.5K May 30 06:12 ossec.conf

You might want to spin up a test installation of Security Onion (perhaps in a VM) and then compare the two installations side-by-side looking for differences.