I recently updated to 2.5.1 on Gentoo, and the init script isn't working quite right. For some reason (I've not found the specific error) ossec-remoted seems to start fine but crashes out. I turned oh debug, and the last line logged by remoted is INFO: Started (pid: 32252), however it's not running.
I found that if I ran ossec-remoted with -u ossec it works fine. I ended up adding a call to that after the call to ossec-control start and that's worked around the problem for me. Am I simply missing some configuration that tells ossec-control what user to start processes at? I noticed that the various daemons are starting as various users (monitord starts as ossec for example, many others are starting as root). Did I just miss a step where the owner/group of the ossec dirs should have been changed? Thanks for any tips.
