Hi Matthew, You get these errors when ossec-analysisd fails to start. Can you do a:
# cat /var/ossec/logs/ossec.log |grep -E "ERROR|WARN" Also, are you using the local or server install? Show us: # cat /etc/ossec-init.conf # uname -a # ps auwx |grep ossec If you restart ossec, does it starts up fine? Thanks for testing the beta and for the report. -- Daniel B. Cid dcid ( at ) ossec.net On Tue, Apr 15, 2008 at 11:06 AM, Gansert, Matthew A <[EMAIL PROTECTED]> wrote: > > > Hi List, > > I'm getting the following alerts during beta testing. This was a clean > install of ossec-hids-080412. > > [qdc345t]:[/var]# /etc/init.d/ossec restart > ossec-monitord not running .. > ossec-logcollector not running ... > ossec-remoted not running .. > ossec-syscheckd not running ... > ossec-analysisd not running .. > ossec-maild not running ... > ossec-execd not running .. > ossec-dbd not running .. > OSSEC HIDS v1.5 Stopped > Starting OSSEC HIDS v1.5 (by Daniel B. Cid)... > Started ossec-dbd... > 2008/04/15 10:00:27 ossec-maild: INFO: E-Mail notification disabled. Clean > Exit. > Started ossec-maild... > Started ossec-execd... > Started ossec-analysisd... > Started ossec-logcollector... > Started ossec-remoted... > 2008/04/15 10:00:32 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:32 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:40 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:40 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:53 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:53 ossec-rootcheck(1211): ERROR: Unable to access queue: > '/var/ossec/queue/ossec/queue'. Giving up.. > > Additionally, OSSEC-WUI (which doesn't have its version information > anywhere in "about") is complaining: > > Warning: opendir(/var/ossec) [function.opendir]: failed to open dir: > Permission denied in /var/www/ossecwui/lib/os_lib_handle.php on line 94 > Unable to access ossec directory. > > [qdcwl99ah88t]:[/var]# ls -lrah | grep ossec > drw-rw---- 11 root ossec 4.0K 2008-04-14 18:35 ossec > [qdcwl99ah88t]:[/var]# ls -lrah ossec > total 44K > dr-xr-x--- 3 root ossec 4.0K 2008-04-15 10:00 var > dr-xr-x--- 2 root ossec 4.0K 2008-04-14 18:35 tmp > drwxr-x--- 5 ossec ossec 4.0K 2008-04-14 18:36 stats > dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:35 rules > dr-xr-x--- 9 root ossec 4.0K 2008-04-14 18:35 queue > drwxr-x--- 5 ossec ossec 4.0K 2008-04-15 06:25 logs > dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:37 etc > dr-xr-x--- 2 root ossec 4.0K 2008-04-14 18:36 bin > dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:35 active-response > drwxr-xr-x 16 root root 4.0K 2008-04-14 18:35 ... > drw-rw---- 11 root ossec 4.0K 2008-04-14 18:35 .. > > Note: after playing with permissions, it doesn't appear these messages are > related. > > Matthew > > ------------------------------------------ > The contents of this message, together with any attachments, are intended > only for the use of the person(s) to which they are addressed and may > contain confidential and/or privileged information. Further, any medical > information herein is confidential and protected by law. It is unlawful for > unauthorized persons to use, review, copy, disclose, or disseminate > confidential medical information. If you are not the intended recipient, > immediately advise the sender and delete this message and any attachments. > Any distribution, or copying of this message, or any attachment, is > prohibited.
