Hi Chris,

Can you run analysisd under gdb? I am using this option on many installs
without any issues.

Just stop OSSEC and run:

# gdb /var/ossec/bin/ossec-analysisd

inside GDB's shell:

(gdb) set follow-fork-mode child
(gdb) run

After that, on another terminal start the other processes:

# /var/ossec/bin/ossec-remoted
# /var/ossec/bin/ossec-syscheckd
# /var/ossec/bin/ossec-logcollecotr

When analysisd crashes, run "bt" and send us the output.

Thanks!



On Wed, Oct 6, 2010 at 11:24 AM, Chris Decker <[email protected]> wrote:
> Michael,
>
> Thank you for replying...
>
> I used a fresh install of 2.5 for the manager and agent.  When I began
> experiencing these issues, I started upgrading with snapshots to see if the
> issue had been fixed.
>
> I agree it is strange that I'm the only one having the issue--perhaps the
> report_changes option isn't used much yet?  Even stranger is that I've
> experienced it on my VMs at home AND in my lab environment at work, making
> me think it was a misconfiguration.  However, my test configuration is
> nothing fancy and is very barebones, so I highly doubt it is a
> misconfiguration.
>
> Yes, I experience crashing when using syscheck with realtime disabled and
> report_changes=on.
>
> I'm willing to do whatever it takes to get this resolved.  I've been posting
> to the IRC channel at night, but it seems most people are out living there
> lives when I get on after work.  If someone could walk me through using the
> debugger at night perhaps we could get some clues on the issue.
>
> If you have any suggestions I'll give them a shot..I'm out of ideas!
>
>
>
>
> Thanks,
> Chris
>
>
>
> On Wed, Oct 6, 2010 at 10:10 AM, Michael Starks
> <[email protected]> wrote:
>>
>> On Tue, 5 Oct 2010 21:23:03 -0400, Chris Decker <[email protected]>
>> wrote:
>> > A quick update:
>> > - The new Snapshot released today (which appears to be destined to be
>> the
>> > 2.5.1 release) does not fix my problem as noted below.
>> > - I was re-reading the documentation and noticed this statement: "Real
>> time
>> > only works with directories, not individual files. So you can monitor
>> the
>> > /etc or C:program files directory, but not an individual file like
>> > /etc/file.txt.".  I knew this already, but tried my configuration with
>> > realtime disabled and still experience this issue.
>>
>> Are these new installs or upgrades? Strange that you seem to be the only
>> one reporting this so far. I am running it on CentOS 5.5 and am not having
>> any issues. And you also experience OSSEC crashing with just regular
>> syscheck and not realtime enabled, but with report_changes enabled?
>>
>> --
>> [I] Immutable Security
>> Information Security, Privacy and Personal Liberty
>> http://www.immutablesecurity.com
>
>

Reply via email to