The ossec group does exist. I'm logged in as a standard user (scloster), but using "sudo" to run the command. I've verified that my scloster account is part of the ossec group. I also tried it using sudo -i in the console then running the command and got the same result.
Scott Closter | | CU Technical & Administrative Services Corp. | 250 627 3654 -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: November 19, 2010 4:24 PM To: [email protected] Subject: Re: [ossec-list] 1207 Error running ossec-reportd Are you running this as root? The ossec group exists right? On Fri, Nov 19, 2010 at 6:50 PM, Scott Closter <[email protected]> wrote: > Hi there, I am manually trying to run the ossec-reportd process to have a > look at some of the reporting available, and I am getting the following > error: > > > > ossec-reportd(1207): ERROR: Unable to switch to group: 'ossec'. > > > > I'm running the following for my initial test: > > > > cat /var/ossec/logs/alerts/alerts.log | /var/ossec/ossec-reportd -n > "Failures summary" -f group authentication_failures > > > > The OS I'm using is Ubuntu server 10.04 LTS. > > > > Hopefully someone has come across this and fixed it, fingers crossed J > > > > Scott Closter > > > >
