Turned out to be caused by group ownership of etc/client.keys file. Somehow it had been set to root:root. Switched to root:ossec and OSSEC started up as normal.
Thanks for your help On 25 Oct, 14:07, "dan (ddp)" <[email protected]> wrote: > > What did you try? > > This is generally a misconfiguration somewhere on the system causing > one of the processes to not start properly. > So try running some of the individual processes in debug mode > (/var/ossec/bin/ossec-agentd -d, /var/ossec/bin/ossec-logcollector > -d). > > Make sure you didn't overwrite the key, possibly re-add it on the agent. > > Maybe cutout most of the ossec.conf, the server-ip is the only > necessary part (make sure that's correct). If it starts working with a > minimal configuration, start adding bits of the config back in until > it breaks.
