Ok, had a minor issue -- turned on syscheck for a huge folder - it filled up the disk. I had to rm -rf /var/ossec/queue
Now I can't restart with the new config since the structure is missing. Anyone know what the correct structure of the /var/ossec/queue folder and subsequent subfolders, ownership, permission etc should be?? thanks
