Greetings Keith: I received this error after upgrading to ossec 2.3.
While Daniel and other developers have not answered the why, for me it came down to a custom rule in /var/ossec/rules/local_rules.xml What I recommend doing is backing up /var/ossec/rules/local_rules.xml and putting in an empty one, then restart. If it works ok, then slowly start adding rules back in (or deleting out -- that's what I did, copy the backup file over the empty one, then delete out and then add back in) until you find the rule or rules choking ossec. Thank you.
