Hi,
Look like that I'm able to crash the logcollector process on my ossec server.
I have a cron job that copy a bunch of file almost at the same time for ossec
to parse and this crash the logcollector.
I have define a lot of file for Ossec to monitor in the Ossec.conf. The files
don't exist before 6AM and the cron Job start to grab the file from other
system and paste them to the Ossec directory to be monitor by Ossec. Ossec
find out that the file exist and process it. Is their a limitiation of the
number of file that I can paste at the same time or is their limitation on the
size of the file?
Thanks in advance.
2008/08/22 06:14:57 ossec-logcollector: socketerr (not available).
2008/08/22 06:14:57 ossec-logcollector(1224): ERROR: Error sending message to
queue.
2008/08/22 06:15:00 ossec-logcollector(1210): ERROR: Queue
'/opt/ossec/queue/ossec/queue' not accessible: 'Destination
address required'.
2008/08/22 06:15:00 ossec-logcollector(1211): ERROR: Unable to access queue:
'/opt/ossec/queue/ossec/queue'. Giving up.
.
2008/08/22 06:16:42 ossec-remoted: socketerr (not available).
2008/08/22 06:16:42 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' not
accessible: 'Destination address require
d'.
2008/08/22 06:16:45 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' not
accessible: 'Destination address require
d'.
2008/08/22 06:16:45 ossec-remoted(1211): ERROR: Unable to access queue:
'/queue/ossec/queue'. Giving up..
2008/08/22 06:48:28 ossec-monitord: socketerr (not available).
2008/08/22 06:48:28 ossec-monitord(1224): ERROR: Error sending message to queue.
2008/08/22 07:46:26 ossec-syscheckd: socketerr (not available).
2008/08/22 07:46:26 ossec-rootcheck(1224): ERROR: Error sending message to
queue.
2008/08/22 07:46:29 ossec-syscheckd(1210): ERROR: Queue
'/opt/ossec/queue/ossec/queue' not accessible: 'Destination add
ress required'.
2008/08/22 07:46:29 ossec-rootcheck(1211): ERROR: Unable to access queue:
'/opt/ossec/queue/ossec/queue'. Giving up..
__________________________________________________________________
Connect with friends from any web browser - no download required. Try the new
Yahoo! Canada Messenger for the Web BETA at
http://ca.messenger.yahoo.com/webmessengerpromo.php
