What is the last event entered into the db before the crash? What are the couple of events after that one? It sounds like (without looking at the source to confirm), that something may not be parsed quite right.
On Mon, May 24, 2010 at 1:59 PM, Chad Glynn <[email protected]> wrote: > Has anyone come across the following message in their ossec.log file on > their ossec server? > > 2010/05/22 17:10:10 ZZZ: 1() Merror date or location not NULL > > We have been using ossec for about 2 years now and have been using the > database output option. > > ossec-dbd used to die 1-3 times a month until 9 months ago. its been running > smoothly ever since. A few times when ossec-dbd has died the message above > was in ossec.log with the same timestamp as the last log that was written to > the database. > > ossec-dbd is able to be started (via ossec-control) without any errors. > > ossec-dbd has died twice in the last week, with this message in ossec.log > file. > > Has anyone come across this before? Does anyone know where this error could > be coming from? >
