On Mon, Oct 25, 2010 at 6:56 AM, ItsMikeE <[email protected]> wrote: > I created an RPM package to install OSSEC agent 2.4.1 on RHEL 5, using > files created with a standard installation from an OSSEC agent. > > Updated the original agent to 2.5.1, and then packaged up those files > again. > > When I start the agent I get multiple var/ossec/queue/ossec/queue > error messages, both from syscheckd and rootcheck. > No additional information in ossec.log > > I have seen similar posts, pointing at local_rules, but AFAIK > local_rules only exists on the master, not the agent. > > Running out of ideas >
What did you try? This is generally a misconfiguration somewhere on the system causing one of the processes to not start properly. So try running some of the individual processes in debug mode (/var/ossec/bin/ossec-agentd -d, /var/ossec/bin/ossec-logcollector -d). Make sure you didn't overwrite the key, possibly re-add it on the agent. Maybe cutout most of the ossec.conf, the server-ip is the only necessary part (make sure that's correct). If it starts working with a minimal configuration, start adding bits of the config back in until it breaks.
