I'll give that a go this week and see how it works out. Fortunetly I'm in the early stages of testing so it's not really a big deal.
Scott -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: November 19, 2010 5:05 PM To: [email protected] Subject: Re: [ossec-list] 1207 Error running ossec-reportd The only other instace of this I've seen was fixed with a re-compile/re-install. On Fri, Nov 19, 2010 at 7:31 PM, Scott Closter <[email protected]> wrote: > The ossec group does exist. I'm logged in as a standard user (scloster), > but using "sudo" to run the command. I've verified that my scloster > account is part of the ossec group. I also tried it using sudo -i in the > console then running the command and got the same result. > > Scott Closter | | CU Technical & Administrative Services Corp. | 250 > 627 3654 > > > -----Original Message----- > From: [email protected] [mailto:[email protected]] > On Behalf Of dan (ddp) > Sent: November 19, 2010 4:24 PM > To: [email protected] > Subject: Re: [ossec-list] 1207 Error running ossec-reportd > > Are you running this as root? > > The ossec group exists right? > > > On Fri, Nov 19, 2010 at 6:50 PM, Scott Closter <[email protected]> > wrote: >> Hi there, I am manually trying to run the ossec-reportd process to > have a >> look at some of the reporting available, and I am getting the > following >> error: >> >> >> >> ossec-reportd(1207): ERROR: Unable to switch to group: 'ossec'. >> >> >> >> I'm running the following for my initial test: >> >> >> >> cat /var/ossec/logs/alerts/alerts.log | /var/ossec/ossec-reportd -n >> "Failures summary" -f group authentication_failures >> >> >> >> The OS I'm using is Ubuntu server 10.04 LTS. >> >> >> >> Hopefully someone has come across this and fixed it, fingers crossed J >> >> >> >> Scott Closter >> >> >> >> > >
