Michael, Thank you for replying...
I used a fresh install of 2.5 for the manager and agent. When I began experiencing these issues, I started upgrading with snapshots to see if the issue had been fixed. I agree it is strange that I'm the only one having the issue--perhaps the report_changes option isn't used much yet? Even stranger is that I've experienced it on my VMs at home AND in my lab environment at work, making me think it was a misconfiguration. However, my test configuration is nothing fancy and is very barebones, so I highly doubt it is a misconfiguration. Yes, I experience crashing when using syscheck with realtime disabled and report_changes=on. I'm willing to do whatever it takes to get this resolved. I've been posting to the IRC channel at night, but it seems most people are out living there lives when I get on after work. If someone could walk me through using the debugger at night perhaps we could get some clues on the issue. If you have any suggestions I'll give them a shot..I'm out of ideas! Thanks, Chris On Wed, Oct 6, 2010 at 10:10 AM, Michael Starks < [email protected]> wrote: > > On Tue, 5 Oct 2010 21:23:03 -0400, Chris Decker <[email protected]> > wrote: > > A quick update: > > - The new Snapshot released today (which appears to be destined to be > the > > 2.5.1 release) does not fix my problem as noted below. > > - I was re-reading the documentation and noticed this statement: "Real > time > > only works with directories, not individual files. So you can monitor > the > > /etc or C:program files directory, but not an individual file like > > /etc/file.txt.". I knew this already, but tried my configuration with > > realtime disabled and still experience this issue. > > Are these new installs or upgrades? Strange that you seem to be the only > one reporting this so far. I am running it on CentOS 5.5 and am not having > any issues. And you also experience OSSEC crashing with just regular > syscheck and not realtime enabled, but with report_changes enabled? > > -- > [I] Immutable Security > Information Security, Privacy and Personal Liberty > http://www.immutablesecurity.com >
