Ubuntu – OSSEC installation auto-start

ossecsoftware installationstartup-applications

I have just installed the current stable release of OSSEC (2.8.1) for Ubuntu, but at the end of the installation I noticed that it said:

- System is Debian (Ubuntu or derivative).
 - Init script modified to start OSSEC HIDS during boot.

 - Configuration finished properly.

 - To start OSSEC HIDS:
        /var/ossec/bin/ossec-control start

 - To stop OSSEC HIDS:
        /var/ossec/bin/ossec-control stop

 - The configuration can be viewed or modified at /var/ossec/etc/ossec.conf

So what is OSSEC HIDS, is it the actual program or something else? If it is the actual program then does this mean that I need to add the command /var/ossec/bin/ossec-control start to the list of startup applications?

Information Update:

I have found that unless I run this command to manually start OSSEC HIDS:

sudo /var/ossec/bin/ossec-control start

That if I run the command to check the status:

sudo /var/ossec/bin/ossec-control status

This is the output:

ossec-monitord not running...
ossec-logcollector not running...
ossec-syscheckd not running...
ossec-analysisd not running...
ossec-maild not running...
ossec-execd not running...

So it does not seem that it starts automatically, how can I get it to do this then? I have also found that I cannot add this to the list of startup applications as the start command requires sudo to be executed.


OS Information:

Description:    Ubuntu 14.10
Release:    14.10

Best Answer

One way to run OSSEC at startup is to add the start command to /etc/rc.local before the exit 0 line and after #! /bin/sh. Though this is no longer necessary now that OSSEC supports systemd.