I had this happen yesterday; in my log file was the following: 2009/12/15 02:05:50 ossec-analysisd: Overwrite rule '30114' not found. 2009/12/15 02:05:50 ossec-analysisd(1220): ERROR: Error loading the rules: 'local_rules.xml'. 2009/12/15 02:05:53 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' not accessible: 'Connection refused'.
Check your ossec.log file and see if you can discover the cause of the error. I removed my offending rule with id 30114 and it worked on subsequent restart. On 12/15/09 1:51 PM, "Pachulski, Keith" <[email protected]> wrote: > If someone could shed some light on this I would appreciate it > > Starting OSSEC HIDS v2.3 (by Trend Micro Inc.)... > Started ossec-maild... > Started ossec-execd... > Started ossec-analysisd... > Started ossec-logcollector... > Started ossec-remoted... > 2009/12/15 15:49:33 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:33 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:41 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:41 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:54 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:54 ossec-rootcheck(1211): ERROR: Unable to access queue: > '/var/ossec/queue/ossec/queue'. Giving up.. >
