It's the same error if I start or restart ossec. [qdcwl99ah88t]:[~]# cat /var/ossec/logs/ossec.log |grep -E "ERROR|WARN" 2008/04/15 09:58:28 ossec-remoted(1501): ERROR: No IP or network allowed in the access list for syslog. No reason for running it. Exiting. 2008/04/15 09:58:31 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 09:58:31 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 09:58:35 ossec-logcollector(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 09:58:35 ossec-logcollector(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up.. 2008/04/15 09:58:39 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 09:58:39 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 09:58:52 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 09:58:52 ossec-rootcheck(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up.. 2008/04/15 10:00:29 ossec-remoted(1501): ERROR: No IP or network allowed in the access list for syslog. No reason for running it. Exiting. 2008/04/15 10:00:32 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:32 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:37 ossec-logcollector(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:37 ossec-logcollector(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up.. 2008/04/15 10:00:40 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:40 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:53 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 10:00:53 ossec-rootcheck(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up.. 2008/04/15 11:50:06 ossec-remoted(1501): ERROR: No IP or network allowed in the access list for syslog. No reason for running it. Exiting. 2008/04/15 11:50:09 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 11:50:09 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 11:50:15 ossec-logcollector(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 11:50:15 ossec-logcollector(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up.. 2008/04/15 11:50:17 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 11:50:17 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 11:50:30 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 11:50:30 ossec-rootcheck(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up.. 2008/04/15 14:28:05 ossec-remoted(1501): ERROR: No IP or network allowed in the access list for syslog. No reason for running it. Exiting. 2008/04/15 14:28:08 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 14:28:08 ossec-rootcheck(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 14:28:13 ossec-logcollector(1210): ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2008/04/15 14:28:13 ossec-logcollector(1211): ERROR: Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
[qdcwl99ah88t]:[~]# cat /etc/ossec-init.conf DIRECTORY="/var/ossec" VERSION="1.5-SNP-080412" DATE="Mon Apr 14 18:35:33 EDT 2008" TYPE="server" [qdcwl99ah88t]:[~]# uname -a Linux qdcwl99ah88t 2.6.18-6-parisc #1 Mon Feb 11 09:25:54 UTC 2008 parisc GNU/Linux [qdcwl99ah88t]:[~]# ps auxw| grep ossec root 9946 0.0 0.0 2996 796 pts/0 R+ 14:21 0:00 grep ossec [qdcwl99ah88t]:[~]# Matt -----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of Daniel Cid Sent: Tuesday, April 15, 2008 9:12 PM To: [email protected] Subject: [ossec-list] Re: beta errors Hi Matthew, You get these errors when ossec-analysisd fails to start. Can you do a: # cat /var/ossec/logs/ossec.log |grep -E "ERROR|WARN" Also, are you using the local or server install? Show us: # cat /etc/ossec-init.conf # uname -a # ps auwx |grep ossec If you restart ossec, does it starts up fine? Thanks for testing the beta and for the report. -- Daniel B. Cid dcid ( at ) ossec.net On Tue, Apr 15, 2008 at 11:06 AM, Gansert, Matthew A <[EMAIL PROTECTED]> wrote: > > > Hi List, > > I'm getting the following alerts during beta testing. This was a > clean install of ossec-hids-080412. > > [qdc345t]:[/var]# /etc/init.d/ossec restart ossec-monitord not running > .. > ossec-logcollector not running ... > ossec-remoted not running .. > ossec-syscheckd not running ... > ossec-analysisd not running .. > ossec-maild not running ... > ossec-execd not running .. > ossec-dbd not running .. > OSSEC HIDS v1.5 Stopped > Starting OSSEC HIDS v1.5 (by Daniel B. Cid)... > Started ossec-dbd... > 2008/04/15 10:00:27 ossec-maild: INFO: E-Mail notification disabled. > Clean Exit. > Started ossec-maild... > Started ossec-execd... > Started ossec-analysisd... > Started ossec-logcollector... > Started ossec-remoted... > 2008/04/15 10:00:32 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:32 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:40 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:40 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:53 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2008/04/15 10:00:53 ossec-rootcheck(1211): ERROR: Unable to access queue: > '/var/ossec/queue/ossec/queue'. Giving up.. > > Additionally, OSSEC-WUI (which doesn't have its version information > anywhere in "about") is complaining: > > Warning: opendir(/var/ossec) [function.opendir]: failed to open dir: > Permission denied in /var/www/ossecwui/lib/os_lib_handle.php on line > 94 Unable to access ossec directory. > > [qdcwl99ah88t]:[/var]# ls -lrah | grep ossec > drw-rw---- 11 root ossec 4.0K 2008-04-14 18:35 ossec > [qdcwl99ah88t]:[/var]# ls -lrah ossec total 44K > dr-xr-x--- 3 root ossec 4.0K 2008-04-15 10:00 var > dr-xr-x--- 2 root ossec 4.0K 2008-04-14 18:35 tmp > drwxr-x--- 5 ossec ossec 4.0K 2008-04-14 18:36 stats > dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:35 rules > dr-xr-x--- 9 root ossec 4.0K 2008-04-14 18:35 queue > drwxr-x--- 5 ossec ossec 4.0K 2008-04-15 06:25 logs > dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:37 etc > dr-xr-x--- 2 root ossec 4.0K 2008-04-14 18:36 bin > dr-xr-x--- 3 root ossec 4.0K 2008-04-14 18:35 active-response > drwxr-xr-x 16 root root 4.0K 2008-04-14 18:35 ... > drw-rw---- 11 root ossec 4.0K 2008-04-14 18:35 .. > > Note: after playing with permissions, it doesn't appear these > messages are related. > > Matthew > > ------------------------------------------ > The contents of this message, together with any attachments, are > intended only for the use of the person(s) to which they are addressed > and may contain confidential and/or privileged information. Further, > any medical information herein is confidential and protected by law. > It is unlawful for unauthorized persons to use, review, copy, > disclose, or disseminate confidential medical information. If you are > not the intended recipient, immediately advise the sender and delete this message and any attachments. > Any distribution, or copying of this message, or any attachment, is > prohibited. ------------------------------------------ The contents of this message, together with any attachments, are intended only for the use of the person(s) to which they are addressed and may contain confidential and/or privileged information. Further, any medical information herein is confidential and protected by law. It is unlawful for unauthorized persons to use, review, copy, disclose, or disseminate confidential medical information. If you are not the intended recipient, immediately advise the sender and delete this message and any attachments. Any distribution, or copying of this message, or any attachment, is prohibited.
