Hi, This is a common error and a cause of a lot of confusion :) This just means that that ossec-analysisd died (or is not responding) for some reason. So generally the root cause is a few lines above in the log file.
When this happens, try to run ossec-analysisd manually: # /var/ossec/bin/ossec-analysisd And look at the /var/ossec/logs/ossec.log to see why it is failing. Fix the issue (generally a bad rule or bad config) and restart OSSEC. *This "ossec/queue" is how all the processes send their events to analysisd. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Fri, Dec 11, 2009 at 2:31 PM, Wim Remes <[email protected]> wrote: > Hi, > > I've experienced the same on Solaris 10 (not always). Usually running > .install.sh and choosing update solves this issue. > > Cheers, > > Wim > On 11 Dec 2009, at 16:19, dasec wrote: > >> Hi list >> >> I'm new to OSSEC >> >> I just completed my first install and on start-up I get this error >> message in the log this >> is a Solaris 10 Box >> >> 2009/12/11 10:06:56 ossec-monitord(1211): ERROR: Unable to access >> queue: '/queue/ossec/queue'. Giving up.. >> 2009/12/11 10:07:19 ossec-syscheckd: INFO: Starting syscheck database >> (pre-scan). >> 2009/12/11 10:08:59 ossec-logcollector: socketerr (not available). >> 2009/12/11 10:11:10 ossec-logcollector: socketerr (not available). >> 2009/12/11 10:11:35 ossec-syscheckd: INFO: Finished creating syscheck >> database (pre-scan completed). >> 2009/12/11 10:13:21 ossec-logcollector: socketerr (not available). >> 2009/12/11 10:13:35 ossec-syscheckd: INFO: Starting syscheck scan >> (forwarding database). >> 2009/12/11 10:13:35 ossec-syscheckd: socketerr (not available). >> 2009/12/11 10:13:35 ossec-syscheckd(1224): ERROR: Error sending >> message to queue. >> 2009/12/11 10:13:38 ossec-syscheckd(1210): ERROR: Queue '/opt/ossec/ >> queue/ossec/queue' not accessible: 'Destination address required'. >> 2009/12/11 10:13:38 ossec-syscheckd(1211): ERROR: Unable to access >> queue: '/opt/ossec/queue/ossec/queue'. Giving up.. >> 2009/12/11 10:15:31 ossec-logcollector: socketerr (not available). >> 2009/12/11 10:17:42 ossec-logcollector: socketerr (not available). >> 2009/12/11 10:19:53 ossec-logcollector: socketerr (not available). > >
