What agent version is it? You could try enabling debugging for the agent and see what ossec.conf says. I know I ran into issues w/ ossec 2.6 agent so I use 2.5.1 until another version comes out.
On Jan 24, 7:39 am, btsteve <[email protected]> wrote: > We are running windows server 2008 r2 SP1, and our logfiles are > located in: > > C:\inetpub\logs\LogFiles\W3SVC1 > C:\inetpub\logs\LogFiles\W3SVC2 > C:\inetpub\logs\LogFiles\W3SVC3 > C:\inetpub\logs\LogFiles\W3SVC4 > C:\inetpub\logs\LogFiles\W3SVC5 > C:\inetpub\logs\LogFiles\W3SVC6 > > When ever we try and read logfiles from this location it fails with > error 1103 unable to open file. If we place it in a different > directory we do not have a problem. > > We have checked the permissions and OSSEC is set to run as the system > account and the system account has full control over the directory. We > have tried running it as a user that is a member of the administrators > group. Either way we get the same result. > > Has anyone else encountered this problem? > > Thanks
