That error is coming from the OSSEC plugin to Splunk, rather than from OSSEC itself.
It means that something went wrong when Splunk tried to run ossec_agent_control to get the list of agents and their connected/disconnected status. The most likely thing is that you need to either remove 'sudo' from the command line in ossec_servers.conf (if Splunk is running as root), or add the needed lines in /etc/sudoers to allow the command to run without a password prompt. If you don't care about polling the agent status, you can also just disable the ossec_agent_status scripted input in the Splunk Manager. On Tue, Feb 15, 2011 at 5:14 AM, Ruta Jn <[email protected]> wrote: > Hi, > > I am using ossec and splunk.I get from ossec server:"Error : Unable to run > data collection".What is wrong and how I can fix that problem? > > Regards, > > John > >
