Awesome. Sounds like it may be a bad interaction between the chroot and the symlink. Thanks for following up! dan
On Fri, Oct 1, 2010 at 12:19 PM, Jeff <[email protected]> wrote: > Problem solved. > In this case /var/ossec was a symlink to /workplace/ossec > When installing I chose the default option of /var/ossec. > Deleted the symlink and then deleted /workplace/ossec then ran the > install and specified to install in /workplace/ossec and everything > started up ok. > > On Sep 30, 3:42 pm, "dan (ddp)" <[email protected]> wrote: >> It looks like something went wrong during the install. I'd first try >> running the ./install.sh again and looking for any errors. >> >> >> >> >> >> On Thu, Sep 30, 2010 at 6:31 PM, Jeff <[email protected]> wrote: >> > Installing on Centos 5.3 64 bit. >> > Server install will not start >> >> > 2010/09/30 15:10:04 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ >> > queue/ossec/queue' not accessible: 'Queue not found'. >> >> > 2010/09/30 15:09:58 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/ >> > Temp' >> > 2010/09/30 15:09:58 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/ >> > system32/config' >> > 2010/09/30 15:09:58 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/ >> > system32/spool' >> > 2010/09/30 15:09:58 ossec-analysisd: INFO: Ignoring file: 'C:\WINDOWS/ >> > system32/CatRoot' >> > 2010/09/30 15:09:58 ossec-analysisd(1212): ERROR: Unable to create PID >> > file. >> > 2010/09/30 15:10:04 ossec-syscheckd(1210): ERROR: Queue '/var/ossec/ >> > queue/ossec/queue' not accessible: >> > 'Queue not found'. >> > 2010/09/30 15:10:10 ossec-logcollector(1210): ERROR: Queue '/var/ossec/ >> > queue/ossec/queue' not accessibl >> > e: 'Queue not found'. >> > 2010/09/30 15:10:25 ossec-logcollector(1211): ERROR: Unable to access >> > queue: '/var/ossec/queue/ossec/qu >> > eue'. Giving up.. >> >> Does /var/ossec/queue exist? What are the permissions? It would also >> be interesting to know why analysisd couldn't create a pidfile.
