I found the following hint: http://www.atomicorp.com/wiki/index.php/ASL_Troubleshooting#OSSEC-dbd_Reports:_Lost_connection_to_MySQL_server_during_query
After setting the timeouts to 24 hours (86400 seconds) for my test environment the problems with the "MySQL server has gone away" messages are disappeared and the ossec server is running fine now. /etc/my.cnf wait_timeout = 86400 interactive_timeout = 86400 Regards, Kai-Uwe
