Hi Mike and Corne, I have no idea, since this never happened to me. However, can you provide the Windows version and architecture that is giving you the issue? Also, after you install, you can try to register ossec via the command line by running the ossec-agent command with the "install-service" argument:
> Cd C:\program files\ossec-agent > ossec-agentd.exe install-service You can also try to start it directly from these (not using the services): > Cd C:\program files\ossec-agent > ossec-agentd.exe start Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Sun, Apr 19, 2009 at 3:09 PM, Mike Poe <[email protected]> wrote: > > > > On Feb 19, 5:28 am, Corne Beerse <[email protected]> wrote: >> Hello >> >> While installing the msWindows agent ofossecon a bunch of servers, the >> installation runs without reporting any problem. However, after >> installation only a few servers do run theossec-service. A bunch of >> machines do not show the new service in the services list. >> >> Starting the manage-agent clearly shows the service is not running. >> Trying tostartthe service fails with the error "UnabletostartOSSEC >> (check config)". The configuration is carefully checked and compares >> well to successfull running agents: only the local machine specification >> differs. >> >> Is there a way to debug the installation of the service? >> Is there a way to manually install the service? >> >> Thanks >> >> Corné > > > Was wondering if there was ever a solution to this problem? I've just > downloaded & installed OSSEC on 4 Linux boxes & 5 Windows 2003 boxes. > Experienced the same thing... perfect installation on all boxes, > however on one of the Windows machines the service was not registered > & OSSEC will not run. > > Have... > > Uninstalled, cleaned the registry & reinstalled - still didn't work... > > Manually exported & imported registry entries from a working server to > the problem server (current control set\services & enum\root)... > service shows up in services manager after a reboot, but won't start - > throws an error "Error 193: 0xc1". System event log says "The OSSEC > Hids service failed to start due to the following error: OSSEC Hids is > not a valid Win32 application." Trying to start it from the agent > manager gives the error "Cannot start OSSEC (check config)". > > Any ideas? Of all the windows boxes this was the one I was really > most concerned about monitoring.. go figure. >
