Yes, it is always the same processes (logcollector and syscheckd). The clients were all binary RPM installs.
Permissions and PID files look correct; here are the results after stopping the client: # ps ax |grep oss 7410 ? S 0:00 /var/ossec/bin/client-logcollector 7414 ? S 0:02 /var/ossec/bin/client-syscheckd # ls -lh /var/ossec/var/run/ -rw-r----- 1 root ossec 5 Aug 16 16:53 ossec-logcollector-7410.pid -rw-r----- 1 root ossec 5 Aug 16 16:53 ossec-syscheckd-7414.pid # cat /var/ossec/var/run/ossec-logcollector-7410.pid 7410 # cat /var/ossec/var/run/ossec-syscheckd-7414.pid 7414 Thanks Dan, d. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: Monday, August 16, 2010 9:20 AM To: [email protected] Subject: Re: [ossec-list] Client daemons not detected by OSSEC-control On Mon, Aug 16, 2010 at 8:18 AM, David Porcello <[email protected]> wrote: > Hi all, > > I'm running OSSEC client 2.4.1 on a handful of RedHat EL 5.5 servers and I'm > seeing the following behavior across the board: It appears that > client-logcollector and client-syscheckd aren't detected as running, and > therefore aren't stopped by ossec-control. When this occurs, multiple > instances begin building up with each start or restart request, and new > agent.conf configs are prevented from loading. > > # ps ax |grep ossec |grep -v grep > 24077 ? S 0:00 /var/ossec/bin/ossec-execd > 24081 ? S 0:00 /var/ossec/bin/ossec-agentd > 24085 ? S 0:00 /var/ossec/bin/client-logcollector > 24089 ? S 0:00 /var/ossec/bin/client-syscheckd > > # /var/ossec/bin/ossec-control stop > client-logcollector not running .. > client-syscheckd not running .. > Killing ossec-agentd .. > Killing ossec-execd .. > OSSEC HIDS v2.4 Stopped > > # ps ax |grep ossec |grep -v grep > 24085 ? S 0:00 /var/ossec/bin/client-logcollector > 24089 ? S 0:00 /var/ossec/bin/client-syscheckd > > Found a couple related threads, but none with a resolution. Anyone else > seeing this? > > Thanks, > d. > I haven't had this problem. Is it always the same processes (logcollector and syscheckd)? Did you go through the install.sh on each system, or did you do a binary install? Check ossec/var/run. There should be .pid files in that directory containing the PIDs of the processes. Make sure they correlate correctly to the PIDs of the processes running. Permissions on my system are: -rw-r--r-- 1 root ossec 6 Aug 15 17:16 ossec-logcollector-25513.pid -rw-r--r-- 1 root ossec 6 Aug 15 17:16 ossec-syscheckd-14721.pid NOTICE: The information contained in this e-mail and any attachments is intended solely for the recipient(s) named above, and may be confidential and legally privileged. If you received this e-mail in error, please notify the sender immediately by return e-mail and delete the original message and any copy of it from your computer system. If you are not the intended recipient, you are hereby notified that any review, disclosure, retransmission, dissemination, distribution, copying, or other use of this e-mail, or any of its contents, is strictly prohibited. Although this e-mail and any attachments are believed to be free of any virus or other defects, it is the responsibility of the recipient to ensure that it is virus-free and no responsibility is accepted by the sender for any loss or damage arising if such a virus or defect exists.
