done, and now it works. thanks again dan!
On 29 Apr, 01:59, "dan (ddp)" <ddp...@gmail.com> wrote: > Now that the users and group are added, I would delete the /var/ossec, and > reinstall. > On Apr 28, 2012 7:58 PM, "Gappa" <gapp...@gmail.com> wrote: > > > > > > > > > hi, > > > I have installed ossec 2.6 server on a Mac 10.7.3. > > > i tried to run ossec with ossec-control start but it gave me some > > errors that i fixed adding the 3 ossec users: > > ossec, ossecr, ossecm and the group ossec. > > This time the error i got is : > > > Starting OSSEC HIDS v2.6 (by Trend Micro Inc.)... > > Started ossec-maild... > > Started ossec-execd... > > Started ossec-analysisd... > > Started ossec-logcollector... > > Started ossec-remoted... > > 2012/04/29 01:40:49 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ > > queue/ossec/queue' not accessible: 'Queue not found'. > > 2012/04/29 01:41:04 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ > > queue/ossec/queue' not accessible: 'No such file or directory'. > > 2012/04/29 01:41:15 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ > > queue/ossec/queue' not accessible: 'Queue not found'. > > 2012/04/29 01:41:30 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/ > > queue/ossec/queue' not accessible: 'No such file or directory'. > > 2012/04/29 01:41:46 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ > > queue/ossec/queue' not accessible: 'Queue not found'. > > 2012/04/29 01:42:01 ossec-rootcheck(1211): ERROR: Unable to access > > queue: '/var/ossec/queue/ossec/queue'. Giving up.. > > > surfing on the various answers on internet i think that the problems > > are the permission and the files owners/group. I have all the > > utilities and files, within /var/ossec, with root owner: > > > dr-xr-x--- 3 root wheel 102 28 Apr 10:27 active-response > > dr-xr-x--- 14 root wheel 476 28 Apr 10:27 agentless > > dr-xr-x--- 27 root wheel 918 28 Apr 10:27 bin > > dr-xr-x--- 8 root wheel 272 28 Apr 10:27 etc > > drwxr-x--- 6 root wheel 204 28 Apr 10:27 logs > > dr-xr-x--- 11 root wheel 374 28 Apr 10:27 queue > > dr-xr-x--- 64 root wheel 2176 28 Apr 10:27 rules > > drwxr-x--- 2 root wheel 68 28 Apr 10:27 stats > > dr-xr-x--- 2 root wheel 68 28 Apr 10:27 tmp > > dr-xr-x--- 3 root wheel 102 29 Apr 01:42 var > > > Now, I don't know if the problem is really caused by permissions error > > or something else, furthermore i don't know what owner and group each > > single file need to, so I can't fix it manually. > > If the problems are the files permission so can anyone tell me every > > sigle file what owner and permissions i have to assign to it? > > > thank you!!! > > Gappa
