Hi, I've spent more than 15 hours trying to solve this problem. I browsed each page on the internet (twice). But I could'nt find the solution to my problem. I enabled debugging. I used truss (strace for AIX). The only thing I didn't try is looking into the source code...
Well, my system is an AIX 6.1. Everything was going right until there was no more space on the device (to store the alerts logs). I moved the logs directory to an other partition (/var/logs/ossec) and made a symbolic link pointing to it. But from now, I can't manage to start ossec. In ossec.log I have these lines. 2010/10/26 17:45:49 ossec-maild: DEBUG: Starting ... 2010/10/26 17:45:49 ossec-maild: INFO: E-Mail notification disabled. Clean Exit. 2010/10/26 17:45:49 ossec-execd(1350): INFO: Active response disabled. Exiting. 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Starting ... 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Found user/group ... 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Active response initialized ... 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Read configuration ... 2010/10/26 17:45:49 ossec-logcollector: DEBUG: Starting ... 2010/10/26 17:45:49 ossec-logcollector: DEBUG: Waiting main daemons to settle. 2010/10/26 17:45:49 ossec-remoted: DEBUG: Starting ... 2010/10/26 17:45:49 ossec-rootcheck: DEBUG: Starting ... 2010/10/26 17:45:49 ossec-rootcheck: Rootcheck disabled. Exiting. 2010/10/26 17:45:49 ossec-syscheckd: WARN: Rootcheck module disabled. 2010/10/26 17:45:49 ossec-monitord: DEBUG: Starting ... 2010/10/26 17:45:56 ossec-syscheckd(1210): ERROR: Queue '/app/in/ossec/ queue/ossec/queue' not accessible: 'Connection refused'. actually-analysisd does not start... but why ? Could it be a matter of file permissions ? Thank you.
