I killed all the remaining ossec processes after I stopped ossec. Restarted and everything seems to be working now. Thanks for your help.
On Tuesday, August 27, 2013 10:26:29 AM UTC-4, Jared wrote: > /var/ossec/bin/ossec-control stop > ps aux | grep ossec > kill -9 (the PID of the remaining process(s) that was not stopped) > repeat until there are no more ossec processes > /var/ossec/bin/ossec-control start > > I believe that ././ar is for "active response", do you have that enabled? > > > > > On Tue, Aug 27, 2013 at 9:50 AM, Brian Dilley <[email protected]<javascript:> > > wrote: > >> So I went to restart ossec services and I ran into the following RROR: >> >> 2013/08/27 09:11:54 ossec-remoted(1210): ERROR: Queue '/queue/alerts/ar' >> not accessible: 'Address already in use'. >> >> Now all my agents are discconnected status and I'm not sure, but I think >> it has to do with the error above. ? >> >> so I checked the directory and there is no ar file. >> >> [root@ossec alerts]# pwd >> /var/ossec/queue/alerts >> [root@ossec alerts]# ll >> total 0 >> srw-rw---- 1 root ossec 0 Aug 27 09:36 execq >> >> >> Everything has been running just fine until the restart of the services >> this morning. >> >> I'm not sure what to look for any ideas? >> >> thanks, >> >> Brian >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> For more options, visit https://groups.google.com/groups/opt_out. >> > > > > -- > Thank you, > > Jared R. Greene > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
