Hi, The fix is to find out why it's dying. You should look through your logs to see if there is any mention of it. If you're running linux and it segfaults there should be a message in the logfiles about that.
If it's crashing, you can try running it in gdb. Not sure if the fork thing is needed, but try something like (when ossec-maild is NOT running): # gdb /var/ossec/bin/ossec-maild (gdb) set follow-fork-mode child (gdb) run the (gdb) and '#' above are the prompts. If the maild process crashes, run "bt" and reply with the output. On Fri, Feb 4, 2011 at 5:56 PM, blacklight <[email protected]> wrote: > Hello Folks, > > > We are running OSSEC 2.5.1 > > root@bobo src]# service ossec status > ossec-monitord is running... > ossec-logcollector is running... > ossec-remoted is running... > ossec-syscheckd is running... > ossec-analysisd is running... > ossec-maild: Process 31720 not used by ossec, removing .. > ossec-maild not running... > ossec-execd is running... > ossec-dbd not running... > > [root@bobo src]# service ossec restart > Stopping OSSEC: [ OK ] > Starting OSSEC: 2011/02/04 15:07:25 ossec-testrule: INFO: Reading > local decoder file. > [ OK ] > [root@bobo src]# service ossec status > ossec-monitord is running... > ossec-logcollector is running... > ossec-remoted is running... > ossec-syscheckd is running... > ossec-analysisd is running... > ossec-maild is running... > ossec-execd is running... > ossec-dbd not running... > > > Restarting the OSSEC service takes care of the issue - that is, until > ossec-maild dies out again and I have to restart OSSEC to prop ossec- > maild back up. > > Is there a fix for this situation? > > > Thanks, > > Vietnhi Phuvan
