Setup OSSEC with mySQL and AnaLogi in CentOS 6

By | December 28, 2014

Setting up OSSEC with mySQL and AnaLogi  allows to perform log analysis, file integrity checking, policy monitoring and rootkit detection. OSSEC is an open source host-based intrusion detection system.

Running on different systems (Windows, Linux, MAC, …), collected data can be stored in a mySQL database and some reports can be displayed using the web gui AnaLogi.



Starting from the CentOS 6.4 minimal installation, this procedure relies on three main packages:

    1. mySQL v5.x database
    2. OSSEC v2.7 log analyzer
    3. AnaLogi v1.3 ossec-wui


Install mySQL

Update the system and install mySQL packages and compilers.

# yum update
# yum install mysql-devel mysql-server gcc make


To work properly, SELINUX must be disabled.

# vi /etc/selinux/config


Enable mySQL to start during system boot and start the service.

# chkconfig mysqld on
# service mysqld start


Secure mySQL running the following command.

# /usr/bin/mysql_secure_installation



Install Ossec and create mySQL db

Using the command wget, download the OSSEC package and decompress the file.

# wget
# tar -vxzf ossec-hids-2.7.tar.gz


Because by default is disabled, enable mySQL in OSSEC.

# cd ossec-hids-2.7/src
# make setdb


Create a new mySQL database to save OSSEC alerts.

# mysql -u root -p

mysql> create database ossec;
mysql> grant INSERT,SELECT,UPDATE,CREATE,DELETE,EXECUTE on ossec.* to [email protected];
mysql> set password for [email protected]=PASSWORD(‘password’);
mysql> flush privileges;
mysql> quit


Import the schema for the new database from the OSSEC installation directory ossec-hids-2.7/src/os_dbd/.

# cd ossec-hids-2.7/src/os_dbd
# mysql -u root -p ossec < mysql.schema


Now proceed with OSSEC installation executing the file

# ./


Hit the ENTER button to start the configuration process.


After pressing ENTER, system compiles and install OSSEC in the computer.


If everything goes smoothly, the installation finishes without any warning or error.


If OSSEC works behind a firewall, the communication with the agent occurs through port UDP 1454.

It’s now time to set the mySQL parameters in the OSSEC configuration. Edit the file ossec.conf.

# vi /var/ossec/etc/ossec.conf

Add the following lines:


Last step, enable mySQL and restart the service.

# /var/ossec/bin/ossec-control enable database
# /var/ossec/bin/ossec-control restart



Install AnaLogi web interface

Because AnaLogi is a web interface for OSSEC that replaced the outdated ossec-wui, we need toinstall Apache and PHP in our system.

# yum install httpd php php-mysql mod_ssl


Enable Apache to start during system boot and start the service.

# chkconfig httpd on
# service httpd restart


Because AnaLogi is stored using git repository, we need to install the git package to retrieve the files from the website.

# yum install git-core

Once installed git, download the AnaLogi package using git clone command.

# cd /var/www/html
# git clone


Assign ownership of AnaLogi directory to user apache.

# chown apache:apache analogi -R

Rename the configuration file.

# cd /var/www/html/analogi
# mv db_ossec.php


Edit the db_ossec.php file and amend the SQL parameters to reflect your installation.

# vi db_ossec.php


If you want creating a virtual host, edit the Apache configuration file and add the following lines:

# vi /etc/httpd/conf/httpd.conf


Restart Apache.

# service httpd restart

Open your browser and type the URL address:



If you can see a similar screen, OSSEC server is working properly.



The OSSEC server is now fully functional, last step to perform is the creation of agents for your clients.



During the time data stored in the database make the DB itself quite huge. Two files become quite big: data.MYD and alerts.MYD.

Check the files size with command:

# cd /var/lib/mysql/ossec/
# du * -h

If the size is too big, there are to steps to perform:

  1. database backup
  2. tables truncate

Once performed the backup, from the console type the command:

# mysql -u root -p

mysql> show databases;
mysql> use ossec;
mysql> truncate table data;
mysql> truncate table alert;
mysql> quit;

Files size is now smaller.


Delete the integrity history and the alerts.

Stop OSSEC service:

# service ossec stop

Clear the file integrity history:

# /var/ossec/bin/syscheck_update -a

Delete all alerts removing the whole /var/ossec/logs/alerts/* directory:

# rm -rf /var/ossec/logs/alerts/*

Start OSSEC service:

# service ossec start

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.