I have ossec setup to output to mysql. Everything appears to be running fine but every so often it reports an error.
ossec-dbd(5202): ERROR: Error connecting to database 'localhost'(ossecdb): ERROR: Access denied for user 'ossecamd'@'localhost' (using password: YES). What is odd about this is the error contains a typo from when I was originally trying to set it up. I mistyped the username. Even though the name is now correct in the connection string and ossec can connect and write data into the database this old failed attempt keeps showing up. Is this cached somewhere? Restarting ossec doesn't appear to make any difference. Thanks, Mike
