What OS/revision is this agent? Could an active response be blocking the agent somehow?
On Wed, Jan 12, 2011 at 4:24 AM, Henry <[email protected]> wrote: > I have edited the agent's internal_options.conf and enable the debug > mode, the messages that I received is as follows: > > The ids server is able to bring up, but it is down within one hour of > operation, any suggestions, thanks. > > 2011/01/10 06:28:05 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:07 ossec-syscheckd: INFO: Starting syscheck scan > (forwarding database). > 2011/01/10 06:28:07 ossec-syscheckd: INFO: Starting syscheck database > (pre-scan). > 2011/01/10 06:28:07 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:09 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:11 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:13 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:15 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:17 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:19 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:21 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:23 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:25 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:28 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:30 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:32 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:34 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:36 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:38 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:40 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:41 ossec-syscheckd: socket busy .. > 2011/01/10 06:28:42 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:44 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:46 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:48 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:50 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:51 ossec-syscheckd: socket busy .. > 2011/01/10 06:28:51 ossec-syscheckd(1224): ERROR: Error sending > message to queue. > 2011/01/10 06:28:52 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:54 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:56 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:28:58 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:29:00 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:29:00 ossec-syscheckd: socket busy .. > 2011/01/10 06:29:02 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:29:04 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:29:06 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:29:08 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:29:10 ossec-logcollector: Message not complete. Trying > again: '' > 2011/01/10 06:29:10 ossec-syscheckd: socket busy .. > 2011/01/10 06:29:10 ossec-syscheckd: socketerr (not available). > 2011/01/10 06:29:10 ossec-syscheckd(1224): ERROR: Error sending > message to queue. >
