Hi List, I'm getting the following alerts during beta testing. This was a clean install of ossec-hids-080412. [qdc345t]:[/var]# /etc/init.d/ossec restart ossec-monitord not running .. ossec-logcollector not running .. ossec-remoted not running .. ossec-syscheckd not running .. ossec-analysisd not running .. ossec-maild not running .. ossec-execd not running .. ossec-dbd not running .. OSSEC HIDS v1.5 Stopped Starting OSSEC HIDS v1.5 (by Daniel B. Cid)... Started ossec-dbd... 2008/04/15 10:00:27 ossec-maild: INFO: E-Mail notification disabled. Clean Exit. Started ossec-maild... Started ossec-execd... Started ossec-analysisd... Started ossec-logcollector... Started ossec-remoted... 2008/04/15 10:00:32 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:32 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:40 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:40 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:53 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:53 ossec-rootcheck(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
Additionally, OSSEC-WUI (which doesn't have its version information anywhere in "about") is complaining: Warning: opendir(/var/ossec) [function.opendir <http://10.41.6.185/ossecwui/function.opendir> ]: failed to open dir: Permission denied in /var/www/ossecwui/lib/os_lib_handle.php on line 94 Unable to access ossec directory. [qdcwl99ah88t]:[/var]# ls -lrah | grep ossec drw-rw---- 11 root ossec 4.0K 2008-04-14 18:35 ossec [qdcwl99ah88t]:[/var]# ls -lrah ossec total 44K dr-xr-x--- 3 root ossec 4.0K 2008-04-15 10:00 var dr-xr-x--- 2 root ossec 4.0K 2008-04-14 18:35 tmp drwxr-x--- 5 ossec ossec 4.0K 2008-04-14 18:36 stats dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:35 rules dr-xr-x--- 9 root ossec 4.0K 2008-04-14 18:35 queue drwxr-x--- 5 ossec ossec 4.0K 2008-04-15 06:25 logs dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:37 etc dr-xr-x--- 2 root ossec 4.0K 2008-04-14 18:36 bin dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:35 active-response drwxr-xr-x 16 root root 4.0K 2008-04-14 18:35 .. drw-rw---- 11 root ossec 4.0K 2008-04-14 18:35 . Note: after playing with permissions, it doesn't appear these messages are related. Matthew ------------------------------------------ The contents of this message, together with any attachments, are intended only for the use of the person(s) to which they are addressed and may contain confidential and/or privileged information. Further, any medical information herein is confidential and protected by law. It is unlawful for unauthorized persons to use, review, copy, disclose, or disseminate confidential medical information. If you are not the intended recipient, immediately advise the sender and delete this message and any attachments. Any distribution, or copying of this message, or any attachment, is prohibited.
