Wazuh: Who-data is not available on RHEL 8

[vikman90]

|Wazuh version|Component|Install type|Install method|Platform|
|---|---|---|---|---|
| 3.11.2 | Syscheck | Agent | Packages | RHEL 8.1 |

|Related mailing list thread|
|---|
|Who-data doesn't work under RHEL 8.1 and wazuh-agent 3.11.2|

Settings

<syscheck>
  <directories check_all="yes" whodata="yes">/root/test</directories>
</syscheck>

Syscheck log

Wazuh 3.11.1 (packages) and 3.11.2 (sources)

2020/01/27 00:47:35 ossec-syscheckd: INFO: (6023): No socket found at '/var/ossec/queue/ossec/audit'. Restarting Auditd service.
2020/01/27 00:47:41 ossec-syscheckd: INFO: (6018): Starting file integrity monitoring real-time Whodata engine.

Wazuh 3.11.2 (packages)

2020/01/27 00:24:31 ossec-syscheckd: ERROR: (6620): Audit support not built. Whodata is not available.

[BraulioV]

Hi @vikman90,

To support FIPS in our RPM packages we merged this PR https://github.com/wazuh/wazuh-packages/pull/378. In it, we compiled a newer version of RPM to support FIPS.

After installing it, the new rpmbuild installed in /usr/local/bin doesn't read the macro's file /etc/rpm/macros.dist. This file contains the following macros:

# dist macros.
%rhel 6
%centos 6
%centos_ver 6
%dist .el6
%el6 1

These macros are used here: https://github.com/wazuh/wazuh-packages/blob/c91e69c3ec5ef2ee114dd429aaaa948ea866b9cb/rpms/SPECS/3.11.2/wazuh-agent-3.11.2.spec#L46-L56 to build the agent using one line or other, depending on if you are building the package for CentOS 5 or CentOS 6.

Since these macros rhel and el are not defined, only the code in the else block was executed, adding the macro USE_AUDIT=no always.

To fix this, we added those macros to our custom macro's file in /root/.rpmmacros.

[alberpilot]

Hello all

The RPM package revision 2 was published. Sorry for the inconvenience.

Regards,
Alberto R