On 9/10/06, Colby W <[EMAIL PROTECTED]
> wrote:
Richard,
Did you ever get this resolved?
I am experiencing the same problem with my install of ossec except I am
using Debian Linux, not Solaris.
I tried strace [-f] /usr/local/ossec/bin/ossec-remoted but it was not
successful at starting remoted.
Richard Hopkins wrote:
> Restarted:
>
> shark# ./ossec-control start
> Starting OSSEC HIDS v0.9-1 (by Daniel B. Cid)...
> Started ossec-maild...
> Started ossec-execd...
> Started ossec-analysisd...
> Started ossec-logcollector...
> Started ossec-remoted...
> Started ossec-syscheckd...
> Completed.
>
> Checked its status:
>
> shark# ./ossec-control status
> ossec-logcollector is running...
> ossec-remoted not running...
> ossec-syscheckd is running...
> ossec-analysisd is running...
> ossec-maild is running...
> ossec-execd is running...
>
> Checked that ossec-remoted really wasn't running:
>
> shark# ps -ef | grep remoted
> root 7586 626 0 15:41:26 pts/4 0:00 grep remoted
>
>
> Same error logged:
>
> 2006/08/25 15:40:50 ossec-remoted: Started (pid: 7553).
> 2006/08/25 15:40:50 ossec-remoted: Started (pid: 7555).
> 2006/08/25 15:40:50 ossec-remoted(1210): Queue '/queue/alerts/ar' not
> accessible.
>
> I just tried (with it stopped) removing and recreating the queue/alerts
> directory but with the same startup problem.
>
> (truss -f to the rescue)
>
> Is there anyone out there running a server installation under Solaris 9 who
> isn't having this problem (is there anyone out there....having this same
> problem)?
>
> Cheers,
>
> Richard
