please check if ossec-analysis daemon is running. That's typically the cause of this message.
Last week I got into a similar issue because my ossec-analysisd process was crashing. Couldn't find why, but reinstalling fixed it. I hope it helps On Tue, Aug 27, 2013 at 6:50 AM, Brian Dilley <[email protected]> wrote: > So I went to restart ossec services and I ran into the following RROR: > > 2013/08/27 09:11:54 ossec-remoted(1210): ERROR: Queue '/queue/alerts/ar' > not accessible: 'Address already in use'. > > Now all my agents are discconnected status and I'm not sure, but I think > it has to do with the error above. ? > > so I checked the directory and there is no ar file. > > [root@ossec alerts]# pwd > /var/ossec/queue/alerts > [root@ossec alerts]# ll > total 0 > srw-rw---- 1 root ossec 0 Aug 27 09:36 execq > > > Everything has been running just fine until the restart of the services > this morning. > > I'm not sure what to look for any ideas? > > thanks, > > Brian > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
