Greetings Lyle: What I'm about to share is untested as far as ossec, but I've done this for other applications. Please also note what I'm about to share I've done on CentOS and RedHat, but if Ubuntu works similar, then the same concepts / rules should be able to be applied.
In console mode (out of gui), go to /etc/rc.d and then change to the run level directory for which you boot up (i.e. 3 is common for a server, though you can also see 3, 4, and 5). http://www.comptechdoc.org/os/linux/howlinuxworks/linux_hlrunscripts.html http://www.redhat.com/docs/manuals/linux/RHL-9-Manual/ref-guide/s1-boot-init-shutdown-sysv.html Change to the run level directory, and do a listing. ossec should be S99ossec which being a "S99" prefix means it is being run towards the very end of the bootup. Now, you could try renaming the file to S100ossec to have it run tail end (or any other Sxxx number higher than the others). If that doesn't work, then on the guess the S99's run alphabetically, change the file name (being careful not to lose any linking in any event including the change to S100 for testing) to be alphabetically higher than the others you want to start sooner. Thank you.
