ossec.conf: Global options¶

Overview¶

<ossec_config>
    <global>
        <!--
        Global options here
        -->
    </global>
</ossec_config>

Options¶

global¶

email_notification¶

Enable or disable e-mail alerting.

Default: no

Allowed: yes/no

email_to¶

E-mail recipient of the alerts.

Allowed: Any valid e-mail address

Note

To use granular email configurations, a base configuration is necessary in the <global> section.

email_from¶

E-mail “source” of the alerts.

Allowed: Any valid e-mail address

email_reply_to¶

New in version 3.0.

E-mail “Reply-to” of the alerts.

Allowed: Any valid e-mail address

smtp_server¶

SMTP server.

Allowed: Any valid hostname or IP Address

email_maxperhour¶

Specifies the maximum number of e-mails to be sent per hour. All emails in excess of this setting will be queued for later distribution.

Default: 12

Allowed: Any number from 1 to 9999

Note

At the end of the hour any queued emails will be sent together in one email. This is true whether the mail grouping is enabled or disabled.

email_idsname¶

If set, “X-IDS-OSSEC: ” will be added to the email headers with the specified value.

Allowed: Any name

Note

This was added in OSSEC 2.8.

custom_alert_output¶

Specifies the format of alerts written to the logfile.

Variables:
"$TIMESTAMP"    -       The time the event was processed by OSSEC.
"$FTELL"        -       Unknown
"$RULEALERT"    -       Unknown
"$HOSTNAME"     -       Hostname of the system generating the event.
"$LOCATION"     -       The file the log messages was saved to.
"$RULEID"       -       The rule id of the alert.
"$RULELEVEL"    -       The rule level of the alert.
"$RULECOMMENT"  -       Unknown
"$SRCIP"        -       The source IP specified in the log message.
"$DSTUSER"      -       The destination user specified in the log message.
"$FULLLOG"      -       The original log message.
"$RULEGROUP"    -       The groups containing the rule.

stats¶

Alerting level for the events generated by the statistical analysis.

Default: 8

Allowed: Any level from 0 to 16

logall¶

States if we should store all the events received.

Default: no

Allowed: yes/no

memory_size¶

Sets the memory size for the event correlation.

Default: 1024

Allowed: Any size from 16 to 5096

white_list¶

List of IP addresses that should never be blocked by the active response (one per element). This option is only valid in server and local installs.

Multiples Allowed: yes

Allowed: Any IP address or netblock

host_information¶

Alerting level for the events generated by the host change monitor.

Default: 8

Allowed: Any level from 0 to 16

jsonout_output¶

New in version 2.9.0.

Enable or disable writing of json-formated alerts at /var/ossec/logs/alerts/alerts.json

Default: no

Allowed: yes/no

prelude_output¶

Enables or disables prelude output.

Default: no

Allowed: yes/no

zeromq_output¶

Enable ZeroMQ Output

Warning

ZeroMQ is experimental and will likely change drastically from version to version.

Allowed: yes/no

zeromq_uri¶

This is zeromq URI that the publisher socket will bind to.

Warning

This URI format is defined by the ZeroMQ project.

<zeromq_uri>tcp://localhost:11111/</zeromq_uri>

This will listen for zeromq subscribers on ip address 127.0.0.1 port 11111

<zeromq_uri>tcp://eth0:21212/</zeromq_uri>

This will listen for zeromq subscribers on the ip address assigned to eth0 port 21212

<zeromq_uri>ipc:///alerts-zmq</zeromq_uri>

This will listen for zeromq on the Unix Domain socket /alerts-zmq.

geoip_db_path¶

The full path to the GeoIP IPv4 database file location.

Example:

<geoip_db_path>/etc/GeoLiteCity.dat</geoip_db_path>