On 16 déc, 14:10, Daniel Cid <[email protected]> wrote: > Hi, > > This is a common error and a cause of a lot of confusion :) This just > means that that ossec-analysisd > died (or is not responding) for some reason. So generally the root > cause is a few lines above in the log > file. > > When this happens, try to run ossec-analysisd manually: > > # /var/ossec/bin/ossec-analysisd Hi! And thank you for the responses. I solved the issue by rearranging Dir permissions Which enabled the ossec user to read and Wright to a the /opt/ossec dir.
My mistake > > And look at the /var/ossec/logs/ossec.log to see why it is failing. > Fix the issue (generally a bad rule or > bad config) and restart OSSEC. > > *This "ossec/queue" is how all the processes send their events to analysisd. > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > > On Fri, Dec 11, 2009 at 2:31 PM, Wim Remes <[email protected]> wrote: > > Hi, > > > I've experienced the same on Solaris 10 (not always). Usually running > > .install.sh and choosing update solves this issue. > > > Cheers, > > > Wim > > On 11 Dec 2009, at 16:19, dasec wrote: > > >> Hi list > > >> I'm new to OSSEC > > >> I just completed my first install and on start-up I get this error > >> message in the log this > >> is a Solaris 10 Box > > >> 2009/12/11 10:06:56 ossec-monitord(1211): ERROR: Unable to access > >> queue: '/queue/ossec/queue'. Giving up.. > >> 2009/12/11 10:07:19 ossec-syscheckd: INFO: Starting syscheck database > >> (pre-scan). > >> 2009/12/11 10:08:59 ossec-logcollector: socketerr (not available). > >> 2009/12/11 10:11:10 ossec-logcollector: socketerr (not available). > >> 2009/12/11 10:11:35 ossec-syscheckd: INFO: Finished creating syscheck > >> database (pre-scan completed). > >> 2009/12/11 10:13:21 ossec-logcollector: socketerr (not available). > >> 2009/12/11 10:13:35 ossec-syscheckd: INFO: Starting syscheck scan > >> (forwarding database). > >> 2009/12/11 10:13:35 ossec-syscheckd: socketerr (not available). > >> 2009/12/11 10:13:35 ossec-syscheckd(1224): ERROR: Error sending > >> message to queue. > >> 2009/12/11 10:13:38 ossec-syscheckd(1210): ERROR: Queue '/opt/ossec/ > >> queue/ossec/queue' not accessible: 'Destination address required'. > >> 2009/12/11 10:13:38 ossec-syscheckd(1211): ERROR: Unable to access > >> queue: '/opt/ossec/queue/ossec/queue'. Giving up.. > >> 2009/12/11 10:15:31 ossec-logcollector: socketerr (not available). > >> 2009/12/11 10:17:42 ossec-logcollector: socketerr (not available). > >> 2009/12/11 10:19:53 ossec-logcollector: socketerr (not available).- > >> Masquer le texte des messages précédents - > > - Afficher le texte des messages précédents -
