Hi,
I have edit ossec_agent.py at line 58 as shown:
except Exception, e:
status = [ 'Error: Unable to run data collection. ' + str(e) ]
ossec = None
Result:Now "Error= Unable to run data collection" is fixed.
Thanks.
Regard
________________________________
De : Paul Southerington <[email protected]>
À : [email protected]
Envoyé le : Jeu 17 février 2011, 18h 01min 10s
Objet : Re: Re : Re : [ossec-list] unable to run data collection
What version of Splunk, and what version of the app?
If you run the following commands as root, do you get the same error?
cd /opt/splunk/etc/apps/ossec/bin
/opt/splunk/bin/python ossec_agent_status.py
If you do, then either download the app from SplunkBase again, or edit
ossec_agent.py at line 58 as shown:
except Exception, e:
status = [ 'Error: Unable to run data collection. ' + str(e) ]
ossec = None
That should at least provide a little more detail.
On Thu, Feb 17, 2011 at 7:50 AM, ruta <[email protected]> wrote:
Hi,
>
>When I run "ossec_agent_status" manually,I get a list of all Available Agents
>and all have status "Active".
>When for example I login on ossec agent as root with wrong password,it is
>reported live in Splunk(authentication failure).
>But I still have in Splunk error message:"Unable to run data collection"
>
>Regards,
>
>
>
>
>
>
________________________________
De : dan (ddp) <[email protected]>
>
>À : [email protected]
>Envoyé le : Mer 16 février 2011, 21h 32min 20s
>Objet : Re: Re : [ossec-list] unable to run data collection
>
>
>What happens when you run this "ossec_agent_status" manually?
>
>On Wed, Feb 16, 2011 at 8:03 AM, Ruta Jn <[email protected]> wrote:
>> Hi Paul,
>>
>> As you have suggested,I have tried to remove 'sudo' from the command line in
>> ossec_servers.conf (Splunk is running as root and is installed on the same
>> server as Ossec), but I still have message: Server: Hostname ossec server,
>> Error:Unable to run data collection when I make search in Splunk.
>>
>> Below extract from my code after removing 'sudo',stopping splunk and
>> restarting splunk
>>
>> # Local server, with automatically determined hostname
>>
>> # Uncomment the second line to enable agent management.
>>
>> #
>>
>> [_local]
>>
>> AGENT_CONTROL = /var/ossec/bin/agent_control -l
>>
>> MANAGE_AGENTS = /var/ossec/bin/manage_agents
>>
>> Regards,
>>
>> John
>>
>>
>> ________________________________
>> De : Paul Southerington <[email protected]>
>> À : [email protected]
>> Envoyé le : Mar 15 février 2011, 19h 56min 07s
>> Objet : Re: [ossec-list] unable to run data collection
>>
>>
>> That error is coming from the OSSEC plugin to Splunk, rather than from OSSEC
>> itself.
>> It means that something went wrong when Splunk tried to run
>> ossec_agent_control to get the list of agents and their
>> connected/disconnected status.
>> The most likely thing is that you need to either remove 'sudo' from the
>> command line in ossec_servers.conf (if Splunk is running as root), or add
>> the needed lines in /etc/sudoers to allow the command to run without a
>> password prompt.
>> If you don't care about polling the agent status, you can also just disable
>> the ossec_agent_status scripted input in the Splunk Manager.
>>
>>
>> On Tue, Feb 15, 2011 at 5:14 AM, Ruta Jn <[email protected]> wrote:
>>>
>>> Hi,
>>>
>>> I am using ossec and splunk.I get from ossec server:"Error : Unable to run
>>> data collection".What is wrong and how I can fix that problem?
>>>
>>> Regards,
>>>
>>> John
>>>
>
>
