I had something very similar happen to my setup during testing. There were 2 things that caused this in my system. The first was when I had more agents than the limit. I had to re-compile ossec on the server and increase the max agents number as shown at http://www.ossec.net/wiki/Errors:LargeNumberAgents. The other thing that caused this issue for me was when I re-installed the ossec client on an agent. To fix it when this happened I had to delete the corresponding agent number in the rids directory on the ossec server.
Hope this helps. On Oct 27, 7:57 am, "dan (ddp)" <[email protected]> wrote: > On Wed, Oct 27, 2010 at 7:34 AM, Mike Sievers > > <[email protected]> wrote: > > yes, active response is enabled > > the process is still running > > > ??? > > Is there anything else in the log? > Are ALL of the ossec processes running? > Try running agentd in debug mode. > > > > > > > > > 2010/10/26 dan (ddp) <[email protected]> > > >> On Tue, Oct 26, 2010 at 9:15 AM, Mike Sievers > >> <[email protected]> wrote: > >> > Hi, > > >> > the ossec.log said: > >> > ossec-agentd(1210): ERROR: Queue '/queue/alerts/execq' not accessible: > >> > 'Queue not found'. > > >> > After a reboot of the machine. The folder is empty: > > >> > ls -a > >> > /var/ossec/queue/alerts > >> > (nofile) > > >> > ??? > > >> > Mike > > >> Do you have active response enabled? > >> Are the ossec processes still running?
