I ran the ls command and the file does exist. I just started recently having problems. The system runs usaully about 30 minutes to an hour then analysisd dies.
On Sun, Aug 19, 2012 at 7:49 PM, JB <jjoob...@gmail.com> wrote: > Looks like the Unix sockets do not work at all. > Was OSSEC running OK before you restarted it? > > Were you running as 'root'? > Do 'ls -l /var/ossec/queue/ossec/queue' to see if the file exist. > > > On Friday, August 17, 2012 2:29:19 PM UTC-7, Shaka Lewis wrote: >> >> I get the below errors after restarting ossec. This is version 2.6 >> running on a Linux machine >> >> 2012/08/17 16:55:21 ossec-logcollector: socketerr (not available). >> 2012/08/17 16:55:21 ossec-logcollector(1224): ERROR: Error sending >> message to queue. >> 2012/08/17 16:55:24 ossec-logcollector(1210): ERROR: Queue >> '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. >> 2012/08/17 16:55:24 ossec-logcollector(1211): ERROR: Unable to access >> queue: '/var/ossec/queue/ossec/queue'. Giving up.. >> 2012/08/17 17:09:21 ossec-syscheckd: socketerr (not available). >> 2012/08/17 17:09:21 ossec-rootcheck(1224): ERROR: Error sending >> message to queue. >> 2012/08/17 17:09:24 ossec-syscheckd(1210): ERROR: Queue >> '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. >> 2012/08/17 17:09:24 ossec-rootcheck(1211): ERROR: Unable to access >> queue: '/var/ossec/queue/ossec/queue'. Giving up.. >> 2012/08/17 17:10:41 ossec-monitord: socketerr (not available). >> 2012/08/17 17:10:41 ossec-monitord(1224): ERROR: Error sending message to >> queue. >> 2012/08/17 17:16:41 ossec-monitord: socketerr (not available). >> 2012/08/17 17:16:41 ossec-monitord(1224): ERROR: Error sending message to >> queue. >> 2012/08/17 17:18:41 ossec-monitord: socketerr (not available). >> 2012/08/17 17:18:41 ossec-monitord(1224): ERROR: Error sending message to >> queue. >> 2012/08/17 17:18:41 ossec-monitord: socketerr (not available).
