Tripwire + Logrotate Policy

TruckStuff · 08-02-2004, 07:09 PM

I've been searching for an answer but havent eebn able to find a soluton to this issue.

I've got Tripwire installed on my server. Every weekend when logrotate rotates the sstem logs, Tripwire complains about policy violations. I tried adding a policy of:

Quote:

/var/log/messages -> $(SEC_LOG);

but it still complains. So what are others out there using for a Tripwire policy that doesn't complain about rotated logs?

unSpawn · 08-28-2004, 04:58 AM

What exactly are those errors if I may ask?

TruckStuff · 08-28-2004, 05:41 PM

It complains that the various rotated logs have been changed, e.g. /var/log/messages, /var/log/messages.1. /var/log/messages.2, etc.

I understand why its complaining, I'm just hoping that there is a way to make it not complain so I don't have to update my tripwire DB every week.

TruckStuff · 08-30-2004, 08:43 AM

Here is an example for this AM:

Code:

-------------------------------------------------------------------------------
Rule Name: 'SystemLogs' (/var/log)
Severity Level: 66
-------------------------------------------------------------------------------

Modified:
"/var/log/boot.log"
"/var/log/boot.log.1"
"/var/log/boot.log.2"
"/var/log/boot.log.3"
"/var/log/boot.log.4"
"/var/log/cron"
"/var/log/cron.1"
"/var/log/cron.2"
"/var/log/cron.3"
"/var/log/cron.4"
"/var/log/firewall.log"
"/var/log/firewall.log.1"
"/var/log/firewall.log.2"
"/var/log/firewall.log.3"
"/var/log/firewall.log.4"
"/var/log/maillog"
"/var/log/maillog.1"
"/var/log/maillog.2"
"/var/log/maillog.3"
"/var/log/maillog.4"
"/var/log/messages.1"
"/var/log/messages.2"
"/var/log/messages.3"
"/var/log/messages.4"
"/var/log/rpmpkgs"
"/var/log/rpmpkgs.1"
"/var/log/rpmpkgs.2"
"/var/log/rpmpkgs.3"
"/var/log/rpmpkgs.4"
"/var/log/secure"
"/var/log/secure.1"
"/var/log/secure.2"
"/var/log/secure.3"
"/var/log/secure.4"
"/var/log/spooler"
"/var/log/spooler.1"
"/var/log/spooler.2"
"/var/log/spooler.3"
"/var/log/spooler.4"
"/var/log/xferlog"
"/var/log/xferlog.1"
"/var/log/xferlog.2"
"/var/log/xferlog.3"
"/var/log/xferlog.4"

unSpawn · 08-31-2004, 07:31 PM

I'd try "/var/log -> $(SEC_CONFIG);" on the DIR not specific files.

TruckStuff · 09-02-2004, 08:56 AM

Quote:

Originally posted by unSpawn
I'd try "/var/log -> $(SEC_CONFIG);" on the DIR not specific files.

Unfortunately, that's what I have now:

Code:

# cat twpol.txt | grep /var/log
     /var/log                          -> $(SEC_CONFIG) ;

mstruzak · 09-08-2005, 03:00 PM

In my setup the error is caused by the Inode check every time logs are rotated; try this:

Code:

/var/log                          -> $(SEC_CONFIG) -i ;