On Mon, Aug 16, 2010 at 8:18 AM, David Porcello <[email protected]> wrote: > Hi all, > > I'm running OSSEC client 2.4.1 on a handful of RedHat EL 5.5 servers and I'm > seeing the following behavior across the board: It appears that > client-logcollector and client-syscheckd aren't detected as running, and > therefore aren't stopped by ossec-control. When this occurs, multiple > instances begin building up with each start or restart request, and new > agent.conf configs are prevented from loading. > > # ps ax |grep ossec |grep -v grep > 24077 ? S 0:00 /var/ossec/bin/ossec-execd > 24081 ? S 0:00 /var/ossec/bin/ossec-agentd > 24085 ? S 0:00 /var/ossec/bin/client-logcollector > 24089 ? S 0:00 /var/ossec/bin/client-syscheckd > > # /var/ossec/bin/ossec-control stop > client-logcollector not running .. > client-syscheckd not running .. > Killing ossec-agentd .. > Killing ossec-execd .. > OSSEC HIDS v2.4 Stopped > > # ps ax |grep ossec |grep -v grep > 24085 ? S 0:00 /var/ossec/bin/client-logcollector > 24089 ? S 0:00 /var/ossec/bin/client-syscheckd > > Found a couple related threads, but none with a resolution. Anyone else > seeing this? > > Thanks, > d. >
I haven't had this problem. Is it always the same processes (logcollector and syscheckd)? Did you go through the install.sh on each system, or did you do a binary install? Check ossec/var/run. There should be .pid files in that directory containing the PIDs of the processes. Make sure they correlate correctly to the PIDs of the processes running. Permissions on my system are: -rw-r--r-- 1 root ossec 6 Aug 15 17:16 ossec-logcollector-25513.pid -rw-r--r-- 1 root ossec 6 Aug 15 17:16 ossec-syscheckd-14721.pid
