Yea, after doing some digging I found a reference to this from an ossec-dev page. Turned out while I was editing the local-rules file via vi, I hit I to insert and there was an extra I in the file. It would be awesome if the errors were a bit more useful such as "hey moron you have an error in file X on line 23, check it because I`m not doing jack till you fix it"; other than " ERROR: Queue '/queue/ossec/queue' not accessible: 'Connection refused'." =)
Thanks everyone for the responses... -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Tate Hansen Sent: Tuesday, December 15, 2009 5:30 PM To: [email protected]; '[email protected]' Subject: Re: [ossec-list] ERROR: Queue '/var/ossec/queue/ossec/queue' not accessible I had this happen yesterday; in my log file was the following: 2009/12/15 02:05:50 ossec-analysisd: Overwrite rule '30114' not found. 2009/12/15 02:05:50 ossec-analysisd(1220): ERROR: Error loading the rules: 'local_rules.xml'. 2009/12/15 02:05:53 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' not accessible: 'Connection refused'. Check your ossec.log file and see if you can discover the cause of the error. I removed my offending rule with id 30114 and it worked on subsequent restart. On 12/15/09 1:51 PM, "Pachulski, Keith" <[email protected]> wrote: > If someone could shed some light on this I would appreciate it > > Starting OSSEC HIDS v2.3 (by Trend Micro Inc.)... > Started ossec-maild... > Started ossec-execd... > Started ossec-analysisd... > Started ossec-logcollector... > Started ossec-remoted... > 2009/12/15 15:49:33 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:33 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:41 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:41 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:54 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2009/12/15 15:49:54 ossec-rootcheck(1211): ERROR: Unable to access queue: > '/var/ossec/queue/ossec/queue'. Giving up.. >
