I've searched the archives and I found that someone else had a
-similar- problem with the error message:
ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible.
ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible.
In the discovered situation, the installation was server/agent.
However, I'm not running a server/agent install; the error message
above is popping up on a -local- install.
[EMAIL PROTECTED] ossec-hids-0.9]# grep ossec /etc/passwd
ossec:x:23878:23878::/var/ossec:/sbin/nologin
ossecm:x:23879:23878::/var/ossec:/sbin/nologin
ossece:x:23880:23878::/var/ossec:/sbin/nologin
ossecr:x:23881:23878::/var/ossec:/sbin/nologin
[EMAIL PROTECTED] ossec-hids-0.9]# grep ossec /etc/group
ossec:x:23878:
[EMAIL PROTECTED] ossec-hids-0.9]# su ossec
bash-3.00$ ls -al /var/ossec/queue/ossec/queue
srw-rw---- 1 ossec ossec 0 Aug 30 08:38 /var/ossec/queue/ossec/queue
(yes, I gave ossec a shell for two seconds to verify that the user
could indeed see the file in question)
The system is running FC4.
Thanks for any help
-- Herb
