Check out /var/ossec/logs/ossec.log - that may shed some light as to what's going on. You may have a typo or bad syntax in your ossec.conf or one of the rulesets.
On Dec 15, 12:51 pm, "Pachulski, Keith" <[email protected]> wrote: > If someone could shed some light on this I would appreciate it > > Starting OSSEC HIDS v2.3 (by Trend Micro Inc.)... > Started ossec-maild... > Started ossec-execd... > Started ossec-analysisd... > Started ossec-logcollector... > Started ossec-remoted... > 2009/12/15 15:49:33 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:33 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:41 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:41 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:54 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:54 ossec-rootcheck(1211): ERROR: Unable to access queue: > '/var/ossec/queue/ossec/queue'. Giving up..
