Does your ossec server have a live network connection (at the time of the errors)?
I ran into a similar problem with a previous version/build (I haven't tested whether 1.4 beta acts the same). If the ossec server didn't have a network connection, I would get errors and failures on ossec attempting to access the queue dir. Once I fixed my network connection, ossec was able to access the queues again. It could have just been a coincidence, but that's what worked for me. -Chuck On 10/25/07, Dan <[EMAIL PROTECTED]> wrote: > > Hi List > > I have a problem with my ossec server. During the start it has > problems with accessing the queue. And i checked the permissions. And > there seems no problems. That means, the ossec user has read and > write access. > > Does anyone has a hint for me. > > 2007/10/25 10:21:51 ossec-remoted: Started (pid: 12118). > 2007/10/25 10:21:51 ossec-remoted: Started (pid: 12120). > 2007/10/25 10:21:54 ossec-syscheckd(1210): Queue '/var/ossec/queue/ > ossec/queue' not accessible: 'Connection refused'. > 2007/10/25 10:21:54 ossec-rootcheck(1210): Queue '/var/ossec/queue/ > ossec/queue' not accessible: 'Connection refused'. > 2007/10/25 10:21:54 ossec-remoted(1210): Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2007/10/25 10:21:54 ossec-remoted(1211): Unable to access queue: '/ > queue/ossec/queue'. Giving up.. > 2007/10/25 10:22:00 ossec-logcollector(1210): Queue '/var/ossec/queue/ > ossec/queue' not accessible: 'Connection refused'. > 2007/10/25 10:22:00 ossec-logcollector(1211): Unable to access queue: > '/var/ossec/queue/ossec/queue'. Giving up.. > 2007/10/25 10:22:02 ossec-syscheckd(1210): Queue '/var/ossec/queue/ > ossec/queue' not accessible: 'Connection refused'. > 2007/10/25 10:22:02 ossec-rootcheck(1210): Queue '/var/ossec/queue/ > ossec/queue' not accessible: 'Connection refused'. > 2007/10/25 10:22:15 ossec-syscheckd(1210): Queue '/var/ossec/queue/ > ossec/queue' not accessible: 'Connection refused'. > 2007/10/25 10:22:15 ossec-rootcheck(1211): Unable to access queue: '/ > var/ossec/queue/ossec/queue'. Giving up.. > 2007/10/25 10:22:15 ossec-monitord: Started (pid: 12357). > 2007/10/25 10:22:28 ossec-monitord(1210): Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2007/10/25 10:22:28 ossec-monitord(1211): Unable to access queue: '/ > queue/ossec/queue'. Giving up.. > 2007/10/25 10:22:46 ossec-monitord: Starting ... > 2007/10/25 10:22:46 ossec-monitord: Chrooted to directory: /var/ > ossec, using user: ossec > 2007/10/25 10:22:46 ossec-monitord: Started (pid: 12933). > 2007/10/25 10:22:59 ossec-monitord(1210): Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2007/10/25 10:22:59 ossec-monitord(1211): Unable to access queue: '/ > queue/ossec/queue'. Giving up.. > 2007/10/25 10:23:08 ossec-maild(1225): SIGNAL Received. Exit Cleaning... > 2007/10/25 10:23:08 ossec-maild(1225): SIGNAL Received. Exit Cleaning... > 2007/10/25 10:23:08 ossec-execd(1314): Shutdown received. Deleting > responses. > 2007/10/25 10:23:08 ossec-execd(1225): SIGNAL Received. Exit Cleaning... > 2007/10/25 10:23:08 ossec-execd(1314): Shutdown received. Deleting > responses. > 2007/10/25 10:23:08 ossec-execd(1225): SIGNAL Received. Exit Cleaning... > > Regards, > Daniel >
