On Tue, Nov 23, 2010 at 12:34 PM, <[email protected]> wrote: >> Make sure /var/ossec/queue/ossec exists. > > [r...@ackbar ossec]# pwd > /var/ossec/queue/ossec > [r...@ackbar ossec]# ls -l > total 0 > srw-rw---- 1 ossec ossec 0 2010-11-23 11:56 queue > > >> Did you change anything in ossec.conf? > > no > >> Run "/var/ossec/bin/ossec-logtest -t" > > [r...@ackbar ossec]# /var/ossec/bin/ossec-logtest -t > 2010/11/23 12:33:07 ossec-testrule: INFO: Reading local decoder file. > [r...@ackbar ossec]# > > > Thanks for the reply. > > Scott >
Which version of OSSEC? Why the ancient distro? Any errors in the system logs? Maybe SELinux or something blocking OSSEC from working?
