Hi Nicolas: some suggestions: Check your AIDE,tripwire,etc logs (if you have installed) or syschekd alerts from ossec (maybe can capture the change in the Integrity checksum) Check your ossec.log
salu2 Zaterio Nicolas Arias wrote: > Update, i have chown -R the queue dir and its working now. > > Dont know why it worked fine till 2 days ago... > > Can you help me to dig around this?, just make the call. > > Cheers! > > On Fri, 2006-11-17 at 10:48 -0300, Nicolas Arias wrote: > >> Hello guys! >> >> I have an Ossec "Local" install, it was working fine, but since 2 days >> ago it stopped working. >> >> When i try to restart the service i get: >> >> Starting OSSEC: 2006/11/17 10:43:41 ossec-syscheckd(1210): Queue >> '/var/ossec/queue/ossec/queue' not accessible. >> 2006/11/17 10:43:41 ossec-rootcheck(1210): Queue >> '/var/ossec/queue/ossec/queue' not accessible. >> 2006/11/17 10:43:49 ossec-syscheckd(1210): Queue >> '/var/ossec/queue/ossec/queue' not accessible. >> 2006/11/17 10:43:49 ossec-rootcheck(1210): Queue >> '/var/ossec/queue/ossec/queue' not accessible. >> 2006/11/17 10:44:02 ossec-syscheckd(1210): Queue >> '/var/ossec/queue/ossec/queue' not accessible. >> 2006/11/17 10:44:02 ossec-rootcheck(1211): Unable to access queue: >> '/var/ossec/queue/ossec/queue'. Giving up.. >> [FAILED] >> >> >> Any help? >> >> Thanks! >> >> >>
