Hi Paul, As you have suggested,I have tried to remove 'sudo' from the command line in ossec_servers.conf (Splunk is running as root and is installed on the same server as Ossec), but I still have message:Server: Hostname ossec server, Error:Unable to run data collection when I make search in Splunk.
Below extract from my code after removing 'sudo',stopping splunk and restarting splunk # Local server, with automatically determined hostname # Uncomment the second line to enable agent management. # [_local] AGENT_CONTROL = /var/ossec/bin/agent_control -l MANAGE_AGENTS = /var/ossec/bin/manage_agents Regards, John ________________________________ De : Paul Southerington <[email protected]> À : [email protected] Envoyé le : Mar 15 février 2011, 19h 56min 07s Objet : Re: [ossec-list] unable to run data collection That error is coming from the OSSEC plugin to Splunk, rather than from OSSEC itself. It means that something went wrong when Splunk tried to run ossec_agent_control to get the list of agents and their connected/disconnected status. The most likely thing is that you need to either remove 'sudo' from the command line in ossec_servers.conf (if Splunk is running as root), or add the needed lines in /etc/sudoers to allow the command to run without a password prompt. If you don't care about polling the agent status, you can also just disable the ossec_agent_status scripted input in the Splunk Manager. On Tue, Feb 15, 2011 at 5:14 AM, Ruta Jn <[email protected]> wrote: Hi, > >I am using ossec and splunk.I get from ossec server:"Error : Unable to run >data >collection".What is wrong and how I can fix that problem? > >Regards, > >John > >
