Hi Daniel. I only have ossec for integrity checking, so...
The alerts dont show anything. the defaults perms for that directory should be? Cheers! On Fri, 2006-11-17 at 13:13 -0800, Daniel Ortiz wrote: > Hi Nicolas: > some suggestions: > Check your AIDE,tripwire,etc logs (if you have installed) or syschekd > alerts from ossec (maybe can capture the change in the Integrity checksum) > Check your ossec.log > > salu2 > > Zaterio > > > > Nicolas Arias wrote: > > Update, i have chown -R the queue dir and its working now. > > > > Dont know why it worked fine till 2 days ago... > > > > Can you help me to dig around this?, just make the call. > > > > Cheers! > > > > On Fri, 2006-11-17 at 10:48 -0300, Nicolas Arias wrote: > > > >> Hello guys! > >> > >> I have an Ossec "Local" install, it was working fine, but since 2 days > >> ago it stopped working. > >> > >> When i try to restart the service i get: > >> > >> Starting OSSEC: 2006/11/17 10:43:41 ossec-syscheckd(1210): Queue > >> '/var/ossec/queue/ossec/queue' not accessible. > >> 2006/11/17 10:43:41 ossec-rootcheck(1210): Queue > >> '/var/ossec/queue/ossec/queue' not accessible. > >> 2006/11/17 10:43:49 ossec-syscheckd(1210): Queue > >> '/var/ossec/queue/ossec/queue' not accessible. > >> 2006/11/17 10:43:49 ossec-rootcheck(1210): Queue > >> '/var/ossec/queue/ossec/queue' not accessible. > >> 2006/11/17 10:44:02 ossec-syscheckd(1210): Queue > >> '/var/ossec/queue/ossec/queue' not accessible. > >> 2006/11/17 10:44:02 ossec-rootcheck(1211): Unable to access queue: > >> '/var/ossec/queue/ossec/queue'. Giving up.. > >> [FAILED] > >> > >> > >> Any help? > >> > >> Thanks! > >> > >> > >> > > -- Nicolas Arias Security Officer +54 11 4109 1885 +54 9 11 5455 0055 [EMAIL PROTECTED]
signature.asc
Description: This is a digitally signed message part
