check permissions. remoted normally runs as user ossec. If it woks when
run as root, that implies that ossec can't read(or write) to an
essential file.
On 12/03/2010 09:04 AM, B Walker wrote:
I recently updated to 2.5.1 on Gentoo, and the init script isn't working quite
right. For some reason (I've not found the specific error) ossec-remoted seems
to start fine but crashes out. I turned oh debug, and the last line logged by
remoted is INFO: Started (pid: 32252), however it's not running.
I found that if I ran ossec-remoted with -u ossec it works fine. I ended up
adding a call to that after the call to ossec-control start and that's worked
around the problem for me.
Am I simply missing some configuration that tells ossec-control what user to
start processes at? I noticed that the various daemons are starting as various
users (monitord starts as ossec for example, many others are starting as root).
Did I just miss a step where the owner/group of the ossec dirs should have
been changed?
Thanks for any tips.
--
R. Loyd Darby, OSSIM-OCSE
Project Manager DOC/NOAA/NMFS
Infrastructure coordinator
Southeast Fisheries Science Center
305-361-4297
