What happens when you run this "ossec_agent_status" manually?
On Wed, Feb 16, 2011 at 8:03 AM, Ruta Jn <[email protected]> wrote: > Hi Paul, > > As you have suggested,I have tried to remove 'sudo' from the command line in > ossec_servers.conf (Splunk is running as root and is installed on the same > server as Ossec), but I still have message: Server: Hostname ossec server, > Error:Unable to run data collection when I make search in Splunk. > > Below extract from my code after removing 'sudo',stopping splunk and > restarting splunk > > # Local server, with automatically determined hostname > > # Uncomment the second line to enable agent management. > > # > > [_local] > > AGENT_CONTROL = /var/ossec/bin/agent_control -l > > MANAGE_AGENTS = /var/ossec/bin/manage_agents > > Regards, > > John > > > ________________________________ > De : Paul Southerington <[email protected]> > À : [email protected] > Envoyé le : Mar 15 février 2011, 19h 56min 07s > Objet : Re: [ossec-list] unable to run data collection > > > That error is coming from the OSSEC plugin to Splunk, rather than from OSSEC > itself. > It means that something went wrong when Splunk tried to run > ossec_agent_control to get the list of agents and their > connected/disconnected status. > The most likely thing is that you need to either remove 'sudo' from the > command line in ossec_servers.conf (if Splunk is running as root), or add > the needed lines in /etc/sudoers to allow the command to run without a > password prompt. > If you don't care about polling the agent status, you can also just disable > the ossec_agent_status scripted input in the Splunk Manager. > > > On Tue, Feb 15, 2011 at 5:14 AM, Ruta Jn <[email protected]> wrote: >> >> Hi, >> >> I am using ossec and splunk.I get from ossec server:"Error : Unable to run >> data collection".What is wrong and how I can fix that problem? >> >> Regards, >> >> John >> > > >
