On Tue, Oct 12, 2010 at 3:58 PM, Justin Redman <[email protected]> wrote: > The web server does run as apache. > > Here's a snippet of the error_log after the restart I just did. The errors > just repeat after this. > ---------------------------------------------------------------------------------------------------- > [Tue Oct 12 14:01:18 2010] [notice] SIGHUP received. Attempting to restart > [Tue Oct 12 14:01:18 2010] [notice] Digest: generating secret for digest > authentication ... > [Tue Oct 12 14:01:18 2010] [notice] Digest: done > [Tue Oct 12 14:01:18 2010] [notice] mod_python: Creating 4 session mutexes > based on 256 max processes and 0 max threads. > [Tue Oct 12 14:01:18 2010] [notice] Apache/2.2.3 (Red Hat) configured -- > resuming normal operations > [Tue Oct 12 14:01:25 2010] [error] [client] PHP Notice: Undefined variable: > g_last_changes in /var/www/html/lib/os_lib_syscheck.php on line 360, referer: > http://server/index.php?f=s > [Tue Oct 12 14:01:25 2010] [error] [client] PHP Warning: > fopen(/var/ossec/logs/alerts/alerts.log) [<a > href='function.fopen'>function.fopen</a>]: failed to open stream: No such > file or directory in /var/www/html/lib/os_lib_alerts.php on line 814, > referer: http://server/index.php?f=s > [Tue Oct 12 14:01:27 2010] [error] [client] PHP Notice: Undefined variable: > g_last_changes in /var/www/html/lib/os_lib_syscheck.php on line 360, referer: > http://server/index.php?f=s > [Tue Oct 12 14:01:27 2010] [error] [client PHP Warning: > fopen(/var/ossec/logs/alerts/alerts.log) [<a > href='function.fopen'>function.fopen</a>]: failed to open stream: No such > file or directory in /var/www/html/lib/os_lib_alerts.php on line 814, > referer: http://server/index.php?f=s > ------------------------------------------------------------------------------------------------- > > The /var/ossec/logs/alerts/alerts.log doesn't exist. Shouldn't ossec create > this though? > >
It should exist if you installed ossec to /var/ossec. Are the OSSEC management processes running? Are you receiving emailed alerts?
