Hi Pierre, It looks like that ossec-analysisd is crashing and not ossec-logcollector. The error you are getting means that the socket is not available anymore, so something happened to analysisd.
Can you try it with our v1.6 beta: http://www.ossec.net/files/snapshots/ossec-hids-080822.tar.gz *If you can send us the logs you are using (or privately to me), I can try to reproduce it... Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Fri, Aug 22, 2008 at 10:18 AM, Pierre Boisvert <[EMAIL PROTECTED]> wrote: > > Hi, > > Look like that I'm able to crash the logcollector process on my ossec server. > I have a cron job that copy a bunch of file almost at the same time for > ossec to parse and this crash the logcollector. > > I have define a lot of file for Ossec to monitor in the Ossec.conf. The > files don't exist before 6AM and the cron Job start to grab the file from > other system and paste them to the Ossec directory to be monitor by Ossec. > Ossec find out that the file exist and process it. Is their a limitiation of > the number of file that I can paste at the same time or is their limitation > on the size of the file? > > Thanks in advance. > > 2008/08/22 06:14:57 ossec-logcollector: socketerr (not available). > 2008/08/22 06:14:57 ossec-logcollector(1224): ERROR: Error sending message to > queue. > 2008/08/22 06:15:00 ossec-logcollector(1210): ERROR: Queue > '/opt/ossec/queue/ossec/queue' not accessible: 'Destination > address required'. > 2008/08/22 06:15:00 ossec-logcollector(1211): ERROR: Unable to access queue: > '/opt/ossec/queue/ossec/queue'. Giving up. > . > 2008/08/22 06:16:42 ossec-remoted: socketerr (not available). > 2008/08/22 06:16:42 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' > not accessible: 'Destination address require > d'. > 2008/08/22 06:16:45 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' > not accessible: 'Destination address require > d'. > 2008/08/22 06:16:45 ossec-remoted(1211): ERROR: Unable to access queue: > '/queue/ossec/queue'. Giving up.. > 2008/08/22 06:48:28 ossec-monitord: socketerr (not available). > 2008/08/22 06:48:28 ossec-monitord(1224): ERROR: Error sending message to > queue. > 2008/08/22 07:46:26 ossec-syscheckd: socketerr (not available). > 2008/08/22 07:46:26 ossec-rootcheck(1224): ERROR: Error sending message to > queue. > 2008/08/22 07:46:29 ossec-syscheckd(1210): ERROR: Queue > '/opt/ossec/queue/ossec/queue' not accessible: 'Destination add > ress required'. > 2008/08/22 07:46:29 ossec-rootcheck(1211): ERROR: Unable to access queue: > '/opt/ossec/queue/ossec/queue'. Giving up.. > > > __________________________________________________________________ > Connect with friends from any web browser - no download required. Try the new > Yahoo! Canada Messenger for the Web BETA at > http://ca.messenger.yahoo.com/webmessengerpromo.php >
