4.3.0 #2299

atomicturtle · 2026-08-25T14:05:17Z

atomicturtle
Aug 25, 2026
Maintainer

OSSEC changelog (4.3.0) support@atomicorp.com

Release Maintainers

Scott R. Shinn (https://www.atomicorp.com)

Contributors on this release

Release Notes

OSSEC 4.3.0 adds three main capabilities; other enhancements and fixes are listed below.

FIM maintenance mode — Per-agent mode via agent_control -M (enable, disable, status, end with -u <id>). While enabled, syscheck accepts file changes into the baseline without generating integrity alerts. end restarts syscheck/rootcheck and clears maintenance when that scan finishes (syscheck/rootcheck during OS patching #677, syscheck logs even after restart sometimes #1289, syscheck and OS patching #1681).
TCP/TLS syslog_output — ossec-csyslogd supports TCP and optional TLS (protocol, tls, tls_verify, tls_ca) in addition to UDP. Alert payloads (default/CEF/JSON/Splunk) may use up to OS_MAXSTR instead of a 2048-byte limit (Long syslog messages being truncated when forwarded by syslog_output to graylog. #1762).
ModSecurity audit logs — Collect libmodsecurity serial audit logs with the modsec-audit localfile format, and decode nginx ModSecurity error-log events with new rules (Support for modsecurity's /var/log/modsec_audit.log #1390).

General

@atomicturtle - Add optional TCP and TLS to syslog_output (ossec-csyslogd) (Long syslog messages being truncated when forwarded by syslog_output to graylog. #1762)
@atomicturtle - Raise csyslogd syslog/CEF/JSON alert buffer from 2048 to OS_MAXSTR (Long syslog messages being truncated when forwarded by syslog_output to graylog. #1762)
@atomicturtle - Add Asterisk IPv6 denied decoder so srcip omits square brackets (decoder.xml decodes asterisk IPv6 addresses with their square brackets #1892)
@atomicturtle - Allow manage_agents -f - to bulk-load agents from stdin (make manage_agents accept stdin with -f #459)
@atomicturtle - Ignore deleted agents in list_agents/get_agents; fix OS_RemoveAgent agent-info cleanup (list_agents -n can list deleted agents #244)
@atomicturtle - Support ### trailing comments in CDB list text files (Comments in CDB #1527)
@atomicturtle - Use a dedicated OSSEC iptables chain for firewall-drop active response (Use iptable chains specific to OSSEC for firewall-drop.sh #678)
@atomicturtle - Add ModSecurity / libmodsecurity serial audit log support (modsec-audit log format) plus nginx error-log ModSecurity decoders/rules (Support for modsecurity's /var/log/modsec_audit.log #1390)
@atomicturtle - Add per-agent FIM maintenance mode via agent_control (syscheck/rootcheck during OS patching #677, syscheck logs even after restart sometimes #1289, syscheck and OS patching #1681)
@atomicturtle - Detect Postfix SMTP connect aborts and escalate by source IP (Rule for detecting failures to connect to postfix smtpd #1897)
@atomicturtle - Match Snort [Drop] fast alerts in the snort decoder (Correction needed to "snort" decoder #1926)
@atomicturtle - Decode named client IPs with optional BIND @cookie prefix (named decoder not matching srcip on Ubuntu 20.04 #1927)
@atomicturtle - Add muhstik to blacklisted user-agent rule 31508 (Add muhstik-scan to bad user-agents #1387)
@atomicturtle - Reject dangerous/ambiguous syscheck_control flag combinations such as -r -u (Syscheck_control not failing on invalid arguements #462)
@hyn172 / @atomicturtle - PR 504 - Add Windows interactive (logon type 2) success detail rule 18262
@awiddersheim / @atomicturtle - PR 578 - Refactor Unix MQ start/send retry loops without changing wait budgets
@bchurchill / @atomicturtle - PR 633 - Enable Linux compile/link hardening by default (PIE, FORTIFY, stack protector, full RELRO)
@alex-front / @atomicturtle - PR 1036 - Add cPanel/cpsrvd decoders and rules; tighten postgresql_log so it does not steal cPanel logs (Postgresql decoder is too common? #1132)
@hcw2016 / @atomicturtle - PR 1166 - Backup agent state before remove/force-delete and alert on duplicated IP

Bug Fixes

@atomicturtle - PR 2295 - Fix syscheck queue/restart races and honor FIM <frequency> under realtime
@atomicturtle - Make PCRE2 JIT optional (soft-fail compile, match via pcre2_match) so analysisd starts on macOS (Fails to start on macOS: Syntax error on regex: '$pam_unix$$': 9 #2040)
@atomicturtle - Restore ossec-lua binary names after Lua 5.4.7 upgrade (Is Lua binary name change intentional? #2245)
@atomicturtle - Accept AR expect username (alias of user), fall back to srcuser, and document fixed script argv (Problem with decoders #2104)
@atomicturtle - Decode cPanel login lines from webmaild/whostmgrd/cpaneld as well as cpsrvd (Postgresql decoder is too common? #1132)
@atomicturtle - Avoid FIM false positives from xxx hash placeholders and checksum read failures (Integrity checksum changed found when there is no sha1 #1590, Too may open files silently causes 'xxx' checksums #1704)
@atomicturtle - Match web-accesslog URLs that contain spaces; do not treat POST as a simple ignored request (web-accesslog does not match all web requests #914, GET/POST Requests without any parameters are not taken into account #922)
@atomicturtle - Require more attack-group context and same_location for rule 40501 (False positive "Attacks followed by the addition of an user." #1082)
@atomicturtle - Stop treating MJ12bot as a malicious user agent in rule 31508 (MJ12bot listed as known malicious user agent? #1317)
@atomicturtle - Ignore snap and /dev/loop df 100% alerts under rule 532 (Built-in rule to ignore snap partition state #1418)
@atomicturtle - Label /var/ossec/logs as var_log_t for logrotate and allow logrotate_t on ossec_log_t (OSSEC logrotate SELinux issue #1948)
@atomicturtle - Replace dead Honeynet Project link in rule 40601 (Link doesn't exists #2111)
@atomicturtle - Limit PHP CGI rule 31110 to .php and cgi-bin URLs (False positive "PHP CGI-bin vulnerability attempt." #1101)
@atomicturtle - Ignore ProFTPD sreaddir buffer growth as a false positive (ProFTPD log message false positive #1015)
@atomicturtle - Pass CFLAGS/LDFLAGS into bundled ossec-lua/ossec-luac via MYCFLAGS/MYLDFLAGS (CFLAGS/LDFLAGS are not passed when building bundled LUA binaries #1568)
@atomicturtle - Open csyslogd syslog_output sockets before chroot so hostnames work without losing OS_Connect multi-address fallback (csyslogd crashes when using a hostname for server #1744)
@atomicturtle - Emit a single To: plus one comma-separated Cc: for granular/extra recipients so ISPs stop rejecting duplicate To headers (Alerts being bounced back due to multiple "To" instances in email headers. #1901)
@atomicturtle - Strip Recv-Q/Send-Q from default netstat listen check to stop rule 533 false positives ( false positive when "netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort" because of Recv-Q #495, Rule 533 false positives #2063)
@reyjrar / @atomicturtle - PR 235 - Canonicalize Windows FIM paths so realtime and scheduled scans use the same slash form
@lazyp / @atomicturtle - PR 564 - Skip leading XML declarations (and UTF-8 BOM) in OS_ReadXML
@AdUser / @atomicturtle - PR 2105 - Insert SQL NULL for missing alert src_ip/dst_ip in os_dbd (not the string 'NULL')
@doke2 / @atomicturtle - PR 663 - Log AGENTCONFIG path when reading shared agent.conf in syscheckd
@crlorentzen / @atomicturtle - PR 1124 - Fix PIX/ASA 6-308001/605004/605005 field extraction (masked/empty users, remote IP)

This discussion was created from the release 4.3.0.

Navigation Menu

Uh oh!

4.3.0 #2299

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Uh oh!

4.3.0 #2299

Uh oh!

atomicturtle Aug 25, 2026 Maintainer

Replies: 0 comments

atomicturtle
Aug 25, 2026
Maintainer