Registrations to Open-AudIT forums are now closed. To ask any new questions please visit Opmantek Community Questions.

Open-AudIT

What's on your network?
It is currently Thu Mar 28, 2024 9:19 pm

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 14 posts ] 
Author Message
 Post subject: Audit Stopped Abnormally
PostPosted: Tue Jan 12, 2010 3:31 am 
Offline
Newbie

Joined: Fri Mar 07, 2008 10:08 pm
Posts: 37
Hi

I've been using an older version for years without any problem but just this morning I've downloaded the lastest SVN Version (09.12.23).

I can test successfully LDAP and SMTP connections but when I audit a subnet using the manage audits pages I get "Audit Stopped Abnormally" all through my logs even though I can manually audit the machine from the website.

If I manually run cscript audit.vbs I can fully audit the machines listed in my input_file = "pc_list_file.txt".

Am I right in thinking that the audit.conf file is separate from and not needed when doing "Audits" / "Add Configuration" from the webserver?

These are some of the details from my auditing "server":
name: installer
OS: Windows XP Pro

Audit.vbs UNC Path - //installer/openaudit/audit.vbs
Submit Results To (Optional) - //installer/openaudit/openaudit/admin_pc_add_1.php
Winexe/RemCom.exe Path (Optional) - //installer/openaudit/

These settings I've used by specifying an LDAP connection and the domain administrator/password but I get the same results, "Audit Stopped Abnormally"


Please could someone point me in the right direction / tell me if I've not supplied enough information to enable someone there to help me as this is driving me mad.

Kind regards,
Mark

_________________
[color=#FF0000]OA environment:[/color]
OA Server: Virtual Linux KVM
[color=#FF8000]
1539 devices[/color]


Top
 Profile  
Reply with quote  
PostPosted: Tue Jan 12, 2010 5:10 am 
Offline
Newbie

Joined: Tue Sep 08, 2009 10:52 pm
Posts: 11
I to am getting this error when I try to run audit.exe.

I installed the audit.exe as a service on the macine

[quote]C:\xampp\htdocs\openauditdev\scripts>audit.exe --install
openaudit installed as openaudit.


But when I run it from command line with this command I am getting the same error

[quote]C:\xampp\htdocs\openauditdev\scripts>start /b audit.exe --run-config 1

Is there a debug flag that I can pass to the EXE to see where it is failing?

[quote]C:\xampp\htdocs\openauditdev\scripts>(CRON) 'Running Configuration: LDAP Audit'
(AUDIT)('CROWSC72167') 'Cannot Connect to Host'
(AUDIT)('AFITS03') 'Audit Stopped Abnormally'
(AUDIT)('CROWSHPWLBCDI') 'Audit Stopped Abnormally'
(AUDIT)('CROWSC68321') 'Audit Stopped Abnormally'
(AUDIT)('CROWSC67767') 'Audit Stopped Abnormally'
(AUDIT)('CROWSC72119') 'Audit Stopped Abnormally'
(AUDIT)('CROWSC67074') 'Audit Stopped Abnormally'
(AUDIT)('CROWSC72112') 'Audit Stopped Abnormally'
(AUDIT)('CROWSC68097') 'Audit Stopped Abnormally'
(AUDIT)('CROWSC72114') 'Audit Stopped Abnormally'

Top
 Profile  
Reply with quote  
PostPosted: Tue Jan 12, 2010 7:40 pm 
Offline
Newbie

Joined: Fri Mar 07, 2008 10:08 pm
Posts: 37
You seem to be getting further than I did.

I installed the service and ran it just as you did below but get this output:

[quote]C:\xampplite\htdocs\openaudit\scripts>Use of uninitialized value in numeric eq (
==) at audit.pl line 422.
Use of uninitialized value in string eq at audit.pl line 428.
Use of uninitialized value in substitution (s///) at audit.pl line 440.
Use of uninitialized value in numeric eq (==) at audit.pl line 470.
Use of uninitialized value in numeric eq (==) at audit.pl line 472.
Use of uninitialized value in numeric eq (==) at audit.pl line 474.
Use of uninitialized value in concatenation (.) or string at audit.pl line 478.
Use of uninitialized value $action in string eq at audit.pl line 481.
Use of uninitialized value $action in string eq at audit.pl line 489.
Use of uninitialized value in string eq at audit.pl line 504.
Use of uninitialized value in numeric eq (==) at audit.pl line 422.
Use of uninitialized value in string eq at audit.pl line 428.
Use of uninitialized value in substitution (s///) at audit.pl line 440.
Use of uninitialized value in numeric eq (==) at audit.pl line 470.
Use of uninitialized value in numeric eq (==) at audit.pl line 472.
Use of uninitialized value in numeric eq (==) at audit.pl line 474.
Use of uninitialized value in concatenation (.) or string at audit.pl line 478.
Use of uninitialized value $action in string eq at audit.pl line 481.
Use of uninitialized value $action in string eq at audit.pl line 489.
Use of uninitialized value in string eq at audit.pl line 504.
Use of uninitialized value in hash element at audit.pl line 400.
Use of uninitialized value in subroutine entry at audit.pl line 400.
Can't use string ("") as a subroutine ref while "strict refs" in use at audit.pl
line 400.


It doesn't matter which config I use I still get this error which leads me to believe I've not setup audit properly. I've searched the forums but can't find a quick how to guide for this new way of auditing so could someone point me at it if there is one please?

Cheers,
Mark

_________________
[color=#FF0000]OA environment:[/color]
OA Server: Virtual Linux KVM
[color=#FF8000]
1539 devices[/color]


Top
 Profile  
Reply with quote  
PostPosted: Tue Jan 12, 2010 9:05 pm 
Offline
Moderator
User avatar

Joined: Tue Jan 25, 2005 3:09 am
Posts: 2140
Location: Scotland
I think this is still a work in progress, you should still be able to audit using the audit.vbs and audit.config files as described in the FAQs
Chad and I are still tidying up the new code, (see here... viewtopic.php?f=9&t=3246)
The NMAP from the web interface works well, but I am also having a few teething troubles with the audit service, if you look at my most recent post in the above thread, you will see a work around from Linux. Watch this space, normal service will be resumed as soon as possible :twisted:

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]


Top
 Profile  
Reply with quote  
PostPosted: Wed Jan 13, 2010 12:52 am 
Offline
Newbie

Joined: Fri Mar 07, 2008 10:08 pm
Posts: 37
Ok thanks Andrew this makes sense now. Sorry I didn't see your other thread, guess I was searching for the wrong thing.

Guess I'll have to wait for it to be fixed so I can audit by subnet :/

Cheers,
Mark

_________________
[color=#FF0000]OA environment:[/color]
OA Server: Virtual Linux KVM
[color=#FF8000]
1539 devices[/color]


Top
 Profile  
Reply with quote  
PostPosted: Wed Jan 13, 2010 1:18 am 
Offline
Moderator
User avatar

Joined: Tue Jan 25, 2005 3:09 am
Posts: 2140
Location: Scotland
Well if Chad is back from his vacation, we might ask you to help with the testing.

_________________
Andrew

[size=85]OA Server: Windows XP/ XAMPP, Mandriva/Apache, Ubuntu
Auditing: 300+ Wstns, 20+ Srvrs, Thin clients, Linux boxes, Routers, etc
OS's: Windows XP , W2K Srvr, W2K3 Srvr, W2K8, Vista, Windows 7, Linuxes (and a Mac at home)
LDAP: Active Directory[/size]


Top
 Profile  
Reply with quote  
PostPosted: Wed Jan 13, 2010 7:30 am 
Offline
Newbie

Joined: Fri Mar 07, 2008 10:08 pm
Posts: 37
No worries. It's probably about time I started helping as my company love me for OA.

If it helps, I'm can test OA on XP, 2000 server and maybe 2003 R2 for server side and xp and 32/64bit versions of Vista and 7 clients.

Mark

_________________
[color=#FF0000]OA environment:[/color]
OA Server: Virtual Linux KVM
[color=#FF8000]
1539 devices[/color]


Top
 Profile  
Reply with quote  
PostPosted: Fri Mar 05, 2010 9:28 am 
Offline
Newbie
User avatar

Joined: Fri Mar 05, 2010 9:20 am
Posts: 14
I'm having the same issue with the domain audits.
- I've been running it from [Audits] >> [Manage Audits]
- I know I have LDAP set up correctly
- I've configured audit.conf
- I've served audit.vbs from my webhost as well as from a share that all domain users have access to
- I'm running as the domain admin, and using those credentials for the audit as well
- I've scanned for LDAP changes and seen 401 of them
- I've seen 158 of my workstations show up when i test my LDAP configuration.

but i can't seem to audit my hardware on my network, and while I could implement an audit via group policy and startup scripts, I'd rather not. I'd love to see this system work properly, since it's verbose enough to give me EVERYTHING i need.

If anyone has any ideas, please post here or let me know via PM,
Thanks against hope,
Jacob

_________________
Server Info:
OS : Server 2003 R2 Ent & Server 2008 Ent, Server 2000
Auditing: 120 WinXP or Win7 Pro Desktops (Dell, HP, Lenovo), 30 HP Networked Print devices, Cisco, Dell, DLink switches
LDAP: Active Directory Server 2008 Domain


Top
 Profile  
Reply with quote  
PostPosted: Thu Apr 01, 2010 3:18 am 
Offline
Newbie
User avatar

Joined: Fri Mar 05, 2010 9:20 am
Posts: 14
So my Network Admin had us install ubuntu server 9.10 on a VMWare virtual server (running on a redundant set of Dell ESX servers) we added Ubuntu desktop environment and LAMP. ItÅ› up and running (and only took me 2 or 3 days to learn all the new stuff to get it up), and has open audit installed, and has all the modules it needs for PHP5.

Iḿ getting the same effects as I did before. I have basically the same setup as I did before, except itś all running from the ubuntu virtual box now.

So.. if it can connect, I get audit stopped abnormally.

As a caveat, I have tweaked the config files correctly, and I have also tweaked nmap.vbs and audit.vbs to portray the correct paths and ip addresses.

LDAP is functional, as it shows me ldap changes (all 406 of them) on the home page after auditing the LDAP directory.

I ended up going to each machine in our building and running the audits by hand (IE browser to OA server, click äudit my machine¨, log off, move to next machine..) and it worked great. If we allowed scheduling, Iḿ sure i could do it that way, but we had a conficker virus hit last year that led to the decision to block the service from running, to prevent future propogation of the virus.

Could we just run the audit.vbs script from a startup script we have at logon?
... how would be run an áudit my machine' from a startup script?

_________________
Server Info:
OS : Server 2003 R2 Ent & Server 2008 Ent, Server 2000
Auditing: 120 WinXP or Win7 Pro Desktops (Dell, HP, Lenovo), 30 HP Networked Print devices, Cisco, Dell, DLink switches
LDAP: Active Directory Server 2008 Domain


Top
 Profile  
Reply with quote  
PostPosted: Thu Apr 01, 2010 6:56 am 
Offline
Newbie
User avatar

Joined: Fri Mar 05, 2010 9:20 am
Posts: 14
I got it!

I'm doing my audit now, and it turns out the culprit was the "audit.vbs" being inaccessible to the machines.
I shared it from the "www" directory on my Ubuntu server and I've got results piling in.

Thanks OA devs for being so dedicated to making a great piece of FOSS. thanks to everyone else out there that had problems and led me to my solution.

Awesome! let the auditing begin!

_________________
Server Info:
OS : Server 2003 R2 Ent & Server 2008 Ent, Server 2000
Auditing: 120 WinXP or Win7 Pro Desktops (Dell, HP, Lenovo), 30 HP Networked Print devices, Cisco, Dell, DLink switches
LDAP: Active Directory Server 2008 Domain


Top
 Profile  
Reply with quote  
PostPosted: Sat Apr 03, 2010 8:47 am 
Offline
Newbie

Joined: Thu Apr 01, 2010 7:35 pm
Posts: 25
How did you solve more than share the files from www folder?

Do you run audit.vbs in a logon script or something?


Top
 Profile  
Reply with quote  
PostPosted: Sat May 08, 2010 2:01 am 
Offline
Newbie

Joined: Fri May 07, 2010 8:46 am
Posts: 12
[quote="zeezam"]How did you solve more than share the files from www folder?

Do you run audit.vbs in a logon script or something?


How did you go about running from web service? it only allows me to do a UNC path

Top
 Profile  
Reply with quote  
PostPosted: Thu Jul 08, 2010 2:19 am 
Offline
Newbie

Joined: Thu Jul 08, 2010 1:56 am
Posts: 1
I suppose i found the solution to this problem. At least it works for me.
OA is installed on WinXP (on XAMPP). I use local admin login and password as "Audit Credentials". Scripts folder in OA is shared for everyone (in my case under name "oas"). Audit.vbs UNC Path looks like //ServerName/ShareName/audit.vbs (in my case it is //ruwsd9999/oas/audit.vbs).
Hope it helps.


Top
 Profile  
Reply with quote  
PostPosted: Fri Jul 30, 2010 12:07 pm 
Offline
Newbie
User avatar

Joined: Fri Mar 05, 2010 9:20 am
Posts: 14
I never ended up trying it as a startup script. The deterent from that was the fact that the audit is renamed once it is sent to the machine, and I couldnt figure out a solution to getting that to work.

I re-installed OA on a windows box running xampp, and I'm fighting it again.

I have the exact same issues, and it's r-tarded.

OA Developers: I suggest that you give us the ability to point to audit.vbs as a web link, so we can provide the url for
"http(s)://[OA Server]/OASubdirectory/audit.vbs"

That would effectively solve my issues completely, and probably those of several others.

_________________
Server Info:
OS : Server 2003 R2 Ent & Server 2008 Ent, Server 2000
Auditing: 120 WinXP or Win7 Pro Desktops (Dell, HP, Lenovo), 30 HP Networked Print devices, Cisco, Dell, DLink switches
LDAP: Active Directory Server 2008 Domain


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 14 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group