On Tue, Oct 26, 2010 at 12:12 PM, NewRules <[email protected]> wrote: > Hi, > > I've spent more than 15 hours trying to solve this problem. I browsed > each page on the internet (twice). But I could'nt find the solution to > my problem. > I enabled debugging. > I used truss (strace for AIX). > The only thing I didn't try is looking into the source code... > > > Well, my system is an AIX 6.1. Everything was going right until there > was no more space on the device (to store the alerts logs). > > I moved the logs directory to an other partition (/var/logs/ossec) and > made a symbolic link pointing to it. >
The ossec processes generally chroot to /var/ossec, so moving the logs directory out of there is going to cause problems. > But from now, I can't manage to start ossec. In ossec.log I have these > lines. > > 2010/10/26 17:45:49 ossec-maild: DEBUG: Starting ... > 2010/10/26 17:45:49 ossec-maild: INFO: E-Mail notification disabled. > Clean Exit. > 2010/10/26 17:45:49 ossec-execd(1350): INFO: Active response disabled. > Exiting. > 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Starting ... > 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Found user/group ... > 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Active response > initialized ... > 2010/10/26 17:45:49 ossec-analysisd: DEBUG: Read configuration ... > 2010/10/26 17:45:49 ossec-logcollector: DEBUG: Starting ... > 2010/10/26 17:45:49 ossec-logcollector: DEBUG: Waiting main daemons to > settle. > 2010/10/26 17:45:49 ossec-remoted: DEBUG: Starting ... > 2010/10/26 17:45:49 ossec-rootcheck: DEBUG: Starting ... > 2010/10/26 17:45:49 ossec-rootcheck: Rootcheck disabled. Exiting. > 2010/10/26 17:45:49 ossec-syscheckd: WARN: Rootcheck module disabled. > 2010/10/26 17:45:49 ossec-monitord: DEBUG: Starting ... > 2010/10/26 17:45:56 ossec-syscheckd(1210): ERROR: Queue '/app/in/ossec/ > queue/ossec/queue' not accessible: 'Connection refused'. > > actually-analysisd does not start... but why ? > > Could it be a matter of file permissions ? > > Thank you.
