On Mon, Oct 25, 2010 at 12:43 AM, x509v3 <[email protected]> wrote: > I just upgraded a test infrastructure from 2.4 to 2.5.1. I upgraded > the server first, then my one test agent. > > The startup of both the server and agent looked good, but at soon as I > run syscheck_update, my ossec.log start filling up with the following > messages. > > I've stopped both server and agent, no joy. If I can't update the > database, I'm not sure how to fix this. The analysisd webpage is > empty, so I'm not even sure where to start troubleshooting. I couldn't > find any obvious "database" to nuke and just start over. > > I'm looking for any pointers or hints. > > thanks. > > [r...@server bin]# ./syscheck_update -a > > ** Integrity check database updated. > > [r...@server bin]# 2010/10/24 21:39:38 ossec-analysisd: Invalid > integrity message in the database. > 2010/10/24 21:39:38 ossec-analysisd: Invalid integrity message in the > database. > 2010/10/24 21:39:38 ossec-analysisd: Invalid integrity message in the > database. > 2010/10/24 21:39:38 ossec-analysisd: Invalid integrity message in the > database. > ... repeats a gazillion times
The databases are in /var/ossec/queue/syscheck I'd copy them somewhere else and run "/var/ossec/bin/syscheck_control -u <agent_id>" to clear the database. Then try again. It might be interesting to see what's in the current database, maybe find out why it's "invalid."
