Looks like the Unix sockets do not work at all. Was OSSEC running OK before you restarted it?
Were you running as 'root'? Do 'ls -l /var/ossec/queue/ossec/queue' to see if the file exist. On Friday, August 17, 2012 2:29:19 PM UTC-7, Shaka Lewis wrote: > > I get the below errors after restarting ossec. This is version 2.6 > running on a Linux machine > > 2012/08/17 16:55:21 ossec-logcollector: socketerr (not available). > 2012/08/17 16:55:21 ossec-logcollector(1224): ERROR: Error sending > message to queue. > 2012/08/17 16:55:24 ossec-logcollector(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2012/08/17 16:55:24 ossec-logcollector(1211): ERROR: Unable to access > queue: '/var/ossec/queue/ossec/queue'. Giving up.. > 2012/08/17 17:09:21 ossec-syscheckd: socketerr (not available). > 2012/08/17 17:09:21 ossec-rootcheck(1224): ERROR: Error sending > message to queue. > 2012/08/17 17:09:24 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2012/08/17 17:09:24 ossec-rootcheck(1211): ERROR: Unable to access > queue: '/var/ossec/queue/ossec/queue'. Giving up.. > 2012/08/17 17:10:41 ossec-monitord: socketerr (not available). > 2012/08/17 17:10:41 ossec-monitord(1224): ERROR: Error sending message to > queue. > 2012/08/17 17:16:41 ossec-monitord: socketerr (not available). > 2012/08/17 17:16:41 ossec-monitord(1224): ERROR: Error sending message to > queue. > 2012/08/17 17:18:41 ossec-monitord: socketerr (not available). > 2012/08/17 17:18:41 ossec-monitord(1224): ERROR: Error sending message to > queue. > 2012/08/17 17:18:41 ossec-monitord: socketerr (not available). >
