Hi Colby and Richard,
Can you try the latest snapshot? It should have fixed this problem (permission issues)... http://www.ossec.net/files/snapshots/ossec-hids-060910.tar.gz *just choose the update option during the install. No need to reinstall everything. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On 9/10/06, Colby W <[EMAIL PROTECTED]> wrote:
Richard, Did you ever get this resolved? I am experiencing the same problem with my install of ossec except I am using Debian Linux, not Solaris. I tried strace [-f] /usr/local/ossec/bin/ossec-remoted but it was not successful at starting remoted. Richard Hopkins wrote: > Restarted: > > shark# ./ossec-control start > Starting OSSEC HIDS v0.9-1 (by Daniel B. Cid)... > Started ossec-maild... > Started ossec-execd... > Started ossec-analysisd... > Started ossec-logcollector... > Started ossec-remoted... > Started ossec-syscheckd... > Completed. > > Checked its status: > > shark# ./ossec-control status > ossec-logcollector is running... > ossec-remoted not running... > ossec-syscheckd is running... > ossec-analysisd is running... > ossec-maild is running... > ossec-execd is running... > > Checked that ossec-remoted really wasn't running: > > shark# ps -ef | grep remoted > root 7586 626 0 15:41:26 pts/4 0:00 grep remoted > > > Same error logged: > > 2006/08/25 15:40:50 ossec-remoted: Started (pid: 7553). > 2006/08/25 15:40:50 ossec-remoted: Started (pid: 7555). > 2006/08/25 15:40:50 ossec-remoted(1210): Queue '/queue/alerts/ar' not > accessible. > > I just tried (with it stopped) removing and recreating the queue/alerts > directory but with the same startup problem. > > (truss -f to the rescue) > > Is there anyone out there running a server installation under Solaris 9 who > isn't having this problem (is there anyone out there....having this same > problem)? > > Cheers, > > Richard
