Re: [ossec-list] socketerr messages after restarting ossec, errors occur after the starting the rootcheck scan

[dan (ddp)]

On Fri, Aug 17, 2012 at 5:29 PM, Shaka Lewis <shaka.le...@gmail.com> wrote:
> I get the below errors after restarting ossec.  This is version 2.6
> running on a Linux machine
>
> 2012/08/17 16:55:21 ossec-logcollector: socketerr (not available).
> 2012/08/17 16:55:21 ossec-logcollector(1224): ERROR: Error sending
> message to queue.
> 2012/08/17 16:55:24 ossec-logcollector(1210): ERROR: Queue
> '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
> 2012/08/17 16:55:24 ossec-logcollector(1211): ERROR: Unable to access
> queue: '/var/ossec/queue/ossec/queue'. Giving up..
> 2012/08/17 17:09:21 ossec-syscheckd: socketerr (not available).
> 2012/08/17 17:09:21 ossec-rootcheck(1224): ERROR: Error sending
> message to queue.
> 2012/08/17 17:09:24 ossec-syscheckd(1210): ERROR: Queue
> '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
> 2012/08/17 17:09:24 ossec-rootcheck(1211): ERROR: Unable to access
> queue: '/var/ossec/queue/ossec/queue'. Giving up..
> 2012/08/17 17:10:41 ossec-monitord: socketerr (not available).
> 2012/08/17 17:10:41 ossec-monitord(1224): ERROR: Error sending message to 
> queue.
> 2012/08/17 17:16:41 ossec-monitord: socketerr (not available).
> 2012/08/17 17:16:41 ossec-monitord(1224): ERROR: Error sending message to 
> queue.
> 2012/08/17 17:18:41 ossec-monitord: socketerr (not available).
> 2012/08/17 17:18:41 ossec-monitord(1224): ERROR: Error sending message to 
> queue.
> 2012/08/17 17:18:41 ossec-monitord: socketerr (not available).

These types of errors usually means something was changed incorrectly.
Did you make any changes before restarting? What log messages are
there before the first socketerr? What OSSEC processes are running
when this happens?