Make sure /var/ossec/queue/ossec exists.
[r...@ackbar ossec]# pwd /var/ossec/queue/ossec [r...@ackbar ossec]# ls -l total 0 srw-rw---- 1 ossec ossec 0 2010-11-23 11:56 queue
Did you change anything in ossec.conf?
no
Run "/var/ossec/bin/ossec-logtest -t"
[r...@ackbar ossec]# /var/ossec/bin/ossec-logtest -t 2010/11/23 12:33:07 ossec-testrule: INFO: Reading local decoder file. [r...@ackbar ossec]# Thanks for the reply. Scott
