On Fri, Jul 6, 2012 at 10:36 AM, william allen <[email protected]> wrote: > -----Original Message----- > From: [email protected] [mailto:[email protected]] On > Behalf Of dan (ddp) > Sent: Friday, July 06, 2012 10:03 AM > To: [email protected] > Subject: Re: [ossec-list] OSSEC Clients stopping > > On Fri, Jul 6, 2012 at 9:52 AM, william allen <[email protected]> > wrote: >> -----Original Message----- >> From: [email protected] [mailto:[email protected]] >> On Behalf Of dan (ddp) >> Sent: Friday, July 06, 2012 9:39 AM >> To: [email protected] >> Subject: Re: [ossec-list] OSSEC Clients stopping >> >> On Fri, Jul 6, 2012 at 9:25 AM, william allen <[email protected]> >> wrote: >>> I know this is a normal occurrence with OSSEC. But when it does the >>> shutdown it does not come back up. >>> >>> >>> >>> 2017/07/05 10:42:01 ossec-logcollector(1225): INFO: SIGNAL Received. >>> Exit >>> >>> Cleaning.. >>> >>> 2017/07/05 10:42:01 ossec-logcollector(1225): INFO: SIGNAL Received. >>> Exit Cleaning. >>> >>> 2017/07/05 10:42:01 ossec-agentd(1225): INFO: SIGNAL Received. Exit >>> Cleaning. >>> >>> 2017/07/05 10:42:01 ossec-execd(1314: INFO: Shutdown received. >>> Deleting responses. >>> >>> 2017/07/05 10:42:01 ossec-execd(1225): INFO: SIGNAL Received. Exit >>> Cleaning. >>> >>> >>> >>> I do not get the following startup PID command? >>> >>> >>> >>> 2012/06/29 11:42:51 ossec-execd: INFO: Started (pid: 13571). >>> >>> >>> >>> Thanks, >>> >>> Scott Allen >>> >>> >>> >>> >> >> You want all of the daemons to output the "Started (pid: xxxxx)" message? >> >>> >>> >>> >> Not really important. Maybe I didn't explain very well. I am just >> wondering why on a few of my boxes the client stops with the above >> cleaning items and doesn't restart after completion. >> > > I guess I have to ask: Why did it stop in the first place? > >>I don't know. I have done numerous installs and this is the first time I > have seen this happen. I just did an new install on about 7 boxes. When I >>started 4 of the boxes I got the above where it stopped and didn't start > backup. I don't know why they didn't startup or why the stopped. Is there >>another log to look at besides the OSSEC.LOG? > >>Thanks for the assistance....
Nope, ossec.log is pretty much it. If you start ossec manually (`/var/ossec/bin/ossec-control start`) does it start properly?
