I am currently running ossec 3.6 in local mode and forwarding data to Splunk. I cannot seem to find something similar in wazuh - am I missing something? We really don't want to have a manager as all our data goes to Splunk anyway. We'd like to continue outputting ossec/wazuh data in Splunk format and send straight to Splunk. I've Googled and read the wazuh docs, but cannot find anything that addresses this. Is this possible?
Currently, there is no way to use standalone agents in Wazuh.
However, Wazuh managers also act as an standalone agent. Therefore, if the system you want to monitor is Linux, you can directly install the Wazuh-manager package there and it will take care of collecting and analyzing its local logs. Take a look at this doc, in case it helps Migrating OSSEC server.
If your target version is different from Linux (Windows, macOS, etc), there is no alternative and you will have to install a Wazuh-manager on a linux instance that the agent can report to. Agents without a manager cannot do anything.
I hope this solves your question!
I have a couple of older printers (a Brother and an HP all-in-one) that I want to run as wireless and cloud-based printers. To do so, I bought a Raspberry Pi 2 and set it up as a headless print server following some online tutorials. Both of the printers are accessible wirelessly from my home network, but because my primary computer is a Chromebook and I use Android phones and tablets, the only good way I've found to print to them is using Google Cloud Print.
To do this, I downloaded Chromium onto the Raspberry Pi and signed in using my gmail account. This kind of worked for a few months, but the cloud connection would go down after a few days and I'd have to reboot the Raspberry Pi to get it back (there was probably a better way, but, since it was headless, it just seemed easier to reboot).
Eventually, I got tired of rebooting the Raspberry Pi and I read something on the Internet about upgrading my software to get new versions of the OS and of Chromium. Unfortunately, since doing so, I've been having problems.
Since I'm running headless, my primary means of connecting are via ssh and vnc connections from my Chromebook. ssh is fine, but I can't run Chromium on the Raspberry Pi via ssh (at one time, I found a tutorial on how to do this, but it has since been taken down and I think Google nixed the support for that somewhere along the line).
To start Chromium, I log with a vnc connection. When I log on the first time after a reboot (or after restarting the vnc server), everything works fine. I can use, for instance, the word processor or terminal available through the GUI. All is well. However, if I start Chromium, all of the sudden nothing will accept keyboard input. It is almost as if there is no keyboard connected at all at this point. Mouse input still works fine and I can open and close programs to my heart's content. Closing Chromium doesn't fix the problem. Closing the vnc connection from the client and logging back in doesn't fix the problem. Restarting the vnc server does fix it until I start Chromium again.
I say "almost" above because, even though pressing keys on the keyboard don't appear to do anything, the cursor (especially visible in the terminal window) does flicker with each key press as it would if I were typing actual text.
I've searched for this issue on Google, but my search has turned up very little. There were some lubuntu posts about possibly not using ibus, but, from what I can tell, that is not relevant to my situation. At least, I couldn't find anything ibus in ps and I couldn't find any options in the GUI preferences.
My Raspberry Pi is running what I believe is the latest version of Raspbian (I updated/upgraded again last night to be sure):
pi#raspberrypi:~ $ uname -a
Linux raspberrypi 4.4.21-v7+ #911 SMP Thu Sep 15 14:22:38 BST 2016 armv7l GNU/Linux
pi#raspberrypi:~ $ cat /etc/os-release
PRETTY_NAME="Raspbian GNU/Linux 8 (jessie)"
NAME="Raspbian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=raspbian
ID_LIKE=debian
HOME_URL="http://www.raspbian.org/"
SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"
It's running TightVNC with the following command-line options:
pi#raspberrypi:~ $ ps aux | grep vnc
pi 13537 0.0 2.2 91556 22584 ? S 01:05 0:27 Xtightvnc :1 -desktop X -auth /home/pi/.Xauthority -geometry 1368x768 -depth 24 -rfbwait 120000 -rfbauth /home/pi/.vnc/passwd -rfbport 5901 -fp /usr/share/fonts/X11/misc/,/usr/share/fonts/X11/Type1/,/usr/share/fonts/X11/75dpi/,/usr/share/fonts/X11/100dpi/ -co /etc/X11/rgb
Chromium's chrome://help About section says "Version 51.0.2704.91 Built on Ubuntu 14.04, running on Raspbian 8.0".
Beyond that, I don't know what other software/versions would be relevant, but if anyone can think of anything else that would be helpful, I can update this description.
Through trial and error, I've discovered that the Chromium keyboard/RDP issue seems to be related to particular extensions on my profile.
To verify this, try running Chromium with --disable-extensions.
The particular extensions/apps I've found to be problematic are:
Google Play Music
Plex
As soon as I disable these, keyboard starts working again. Does this help?
I'm running the 4.4.38 version of Raspberry Pi 3, which is the newest, and the newest chromium-browser (v.51). Although I am using a mouse and screen, I'm getting keyboard error messages, and other messages, and browser is hanging in some cases. I pretty quickly see the following errors on console after starting chromium:
[2530:2530:0217/142822:ERROR:sandbox_linux.cc(334)] InitializeSandbox() called with multiple threads in process gpu-process
[75:75:0217/142957:ERROR:PlatformKeyboardEvent.cpp(117)] Not implemented reached in static PlatformEvent::Modifiers blink::PlatformKeyboardEvent::getCurrentModifierState()
After asking on the raspberrypi.org forum, it was suggested that I wait for the next version of Chromium. It looks pretty sure that there is an i/o error between mouse and keyboard controls and chromium, and appears quite similar to your issue.
(I do not have the necessary 50 points, so I cannot comment, only as a solution, which in this case is not true, since I also did not find it yet.)
I have the exact same problem with a Pi 3, but in my case when remotely connected with xrdp (w/ Windows Remote Desktop).
I believe the symptoms appeared after an update-upgrade session. My current version:
pi#raspberrypi:~ $ uname -a
Linux raspberrypi 4.4.38-v7+ #938 SMP Thu Dec 15 15:22:21 GMT 2016 armv7l GNU/Linux
I originally only wanted to change the keyboard-layout to German, and from what I understood until now is that through xrdp it is not possible, unless you define your keyboard layout completely manually, see:
http://forums.fedoraforum.org/showthread.php?t=265100
http://cloclotron.net/xrdp_keyboard_layout_workaround.html
As soon as I open Chromium, I see the same behaviour as you, if I close it, everything is back to normal. If working on a directly connected monitor with kexboard plugged in, I experience no problems.
I recently bought a 3G dongle for a project I'm working on. I want my Raspberry Pi to be able to receive SMS messages and respond to them. I got a HSDPA 3g dongle with a 7.2mbps connection. I've set up the dongle on Windows with an A1 (not sure if you guys know this provider) sim and it works fine. I can connect to the internet just fine and also receive text messages (SMS)
However when I try connecting it to my Raspberry Pi (with Raspbian OS) then it doesn't work. It's always show as a "Mass Storage Device".
I tried my luck with usb_modeswitch and wvdial and with Sakis3g as well, but I can't get it to work. My problem with usb_modeswitch and wvdial was that even after I tried everything explained on these 2 blog posts (https://www.thefanclub.co.za/how-to/how-setup-usb-3g-modem-raspberry-pi-using-usbmodeswitch-and-wvdial ; https://nicovddussen.wordpress.com/2014/11/12/setting-up-your-raspberry-pi-to-work-with-a-3g-dongle/) it still didn't switch to the modem mode. It always stays at the "Mass Storage Mode". I saw an alternative and tried using Sakis3G, but with no luck as well. Seems like their website (sakis3g.org / sakis3g.com) is offline and you can't download certain .tar.gz folders/files anymore. I tried my luck with this blog post. (https://shkspr.mobi/blog/2012/07/3g-internet-on-raspberry-pi-success/)
And you guessed it, I couldn't get it to work either. It doesn't let me download the .gz folder/file because the website appears to be down.
It's a very big problem for my project and I would appreciate any help. It's really important. If anyone knows what I can do to fix this, please offer help. I'd really appreciate it.
Greetings.
Trying using tips supplied in this article
Unplug your modem
Open a terminal prompt
Install the usb-modeswitch package by typing in:
sudo apt-get install usb-modeswitch
EDIT... ADD REBOOT STEP
Reboot Pi
Plug the modem in,
Give it a couple of seconds and then try commands to confirm it worked
lsusb
ifconfig -a
You should see a new interface (Note the name of it - might be something like wwan0 )
To get this to acquire an IP address, edit the file /etc/network/interfaces and add the lines:
allow-hotplug wwan0
iface wwan0 inet dhcp
EDIT - REBOOT AGAIN
........
EDIT - UPDATE
Also note that the full version of sakis3G has this usb-modeswitch embedded in it.
You can still download code and look at instructions at old site that's been archived at:
http://web.archive.org/web/20130511202305/http://www.sakis3g.org/#download
I own a RaspberryPi that I can connect only through ssh. A few days ago it was unsafely powered off. Now when I turn it on I cannot access it. It looks like it turns on but can't get an ip or so.
It is ptovided by fixed IP from router, and when I try to ping this IP, it tells me that the destination host is unreachable.
Is there a way to find out what has happened or the only way is to complete reinstall the OS?
One possibility is that the systems rootfs has been corrupted, this happened to me once with unsafe powerdown on a raspi.
If you have another sd-card, the easiest would be to install a fresh image on it and check if it boots correctly. If not, make an image of your current sd-card, format and reinstall.
Hopefully you've got backups, as there's no guarantee to recover your files if the data has been corrupted.
I have this strange problem in an embedded system (linux) we build, so I don't have normal GUI trouble-shooting tools on Linux or Windows machines.
The problem is the NIC is no longer usable after cable removed. Even if I re-plug the cable, the lights on it never come back on again and nothing can be sent or received. ifconfig still works on the surface, but doesn't have real effect. Only a reboot will solve the problem. I guess the problem is in the ethernet driver.
My question is how the trouble-shoot it. Any clues/hints? Thanks.
====================
Thank you guys! The board is a gumstix and the PHY is SMSC911x. We are running on Linux 3.0.12. It turns out the smsc911x_soft_reset() of the NIC fails when driver calls smsc911x_open(). The symptom also includes we must run ifconfig multiple times (not consistent) to bring the NIC up and the system can detect it.
I did a search on "SMSC911x soft reset failed" and find this link. http://comments.gmane.org/gmane.linux.network/216467. I removed SMSC_PHY=y in the linux build config file and that fixed the problem. It seems the driver is not compatible. Can somebody explain this, or is there a better solution?