What version of Splunk, and what version of the app?
If you run the following commands as root, do you get the same error?
cd /opt/splunk/etc/apps/ossec/bin
/opt/splunk/bin/python ossec_agent_status.py
If you do, then either download the app from SplunkBase again, or edit
ossec_agent.py at line 58 as shown:
except Exception, e:
status = [ 'Error: Unable to run data collection. ' + str(e)
]
ossec = None
That should at least provide a little more detail.
On Thu, Feb 17, 2011 at 7:50 AM, ruta <[email protected]> wrote:
> Hi,
>
> When I run "ossec_agent_status" manually,I get a list of all Available
> Agents and all have status "Active".
> When for example I login on ossec agent as root with wrong password,it is
> reported live in Splunk(authentication failure).
> But I still have in Splunk error message:"Unable to run data collection"
>
> Regards,
>
>
> ------------------------------
> *De :* dan (ddp) <[email protected]>
>
> *À :* [email protected]
> *Envoyé le :* Mer 16 février 2011, 21h 32min 20s
> *Objet :* Re: Re : [ossec-list] unable to run data collection
>
> What happens when you run this "ossec_agent_status" manually?
>
> On Wed, Feb 16, 2011 at 8:03 AM, Ruta Jn <[email protected]> wrote:
> > Hi Paul,
> >
> > As you have suggested,I have tried to remove 'sudo' from the command line
> in
> > ossec_servers.conf (Splunk is running as root and is installed on the
> same
> > server as Ossec), but I still have message: Server: Hostname ossec
> server,
> > Error:Unable to run data collection when I make search in Splunk.
> >
> > Below extract from my code after removing 'sudo',stopping splunk and
> > restarting splunk
> >
> > # Local server, with automatically determined hostname
> >
> > # Uncomment the second line to enable agent management.
> >
> > #
> >
> > [_local]
> >
> > AGENT_CONTROL = /var/ossec/bin/agent_control -l
> >
> > MANAGE_AGENTS = /var/ossec/bin/manage_agents
> >
> > Regards,
> >
> > John
> >
> >
> > ________________________________
> > De : Paul Southerington <[email protected]>
> > À : [email protected]
> > Envoyé le : Mar 15 février 2011, 19h 56min 07s
> > Objet : Re: [ossec-list] unable to run data collection
> >
> >
> > That error is coming from the OSSEC plugin to Splunk, rather than from
> OSSEC
> > itself.
> > It means that something went wrong when Splunk tried to run
> > ossec_agent_control to get the list of agents and their
> > connected/disconnected status.
> > The most likely thing is that you need to either remove 'sudo' from the
> > command line in ossec_servers.conf (if Splunk is running as root), or
> add
> > the needed lines in /etc/sudoers to allow the command to run without a
> > password prompt.
> > If you don't care about polling the agent status, you can also just
> disable
> > the ossec_agent_status scripted input in the Splunk Manager.
> >
> >
> > On Tue, Feb 15, 2011 at 5:14 AM, Ruta Jn <[email protected]> wrote:
> >>
> >> Hi,
> >>
> >> I am using ossec and splunk.I get from ossec server:"Error : Unable to
> run
> >> data collection".What is wrong and how I can fix that problem?
> >>
> >> Regards,
> >>
> >> John
> >>
>
>
