Thanks Dan. That fixed that issue but now looking at others. Appears someone has changed ownership of files in the ossec directory structure and there are still issues which are causing problems with the app including errors like:
2013/09/13 09:30:22 ossec-analysisd: Rules in an inconsistent state. Exiting. -and- 2013/09/13 09:30:30 ossec-logcollector(1224): ERROR: Error sending message to queue. 2013/09/13 09:30:33 ossec-logcollector(1210): ERROR: Queue '/opt/ossec/queue/ossec/queue' not accessible: 'Connection refused'. 2013/09/13 09:30:33 ossec-logcollector(1211): ERROR: Unable to access queue: '/opt/ossec/queue/ossec/queue'. Giving up.. 2013/09/13 09:31:18 ossec-syscheckd: INFO: Starting syscheck scan (forwarding database). 2013/09/13 09:31:18 ossec-syscheckd: socketerr (not available). 2013/09/13 09:31:18 ossec-syscheckd(1224): ERROR: Error sending message to queue. Why always on a Friday??? ;-) -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: Friday, September 13, 2013 9:16 AM To: [email protected] Subject: Re: [ossec-list] "WARN: Process locked. Waiting for permission" At Server When Trying To Start Server On Fri, Sep 13, 2013 at 10:08 AM, MDACC-Luckie <[email protected]> wrote: > I have dealt with issues with agents not connecting to the server with > a > "WARN: Process locked. Waiting for permission" message in the log but > not at the server. When starting OSSEC on the primary OSSEC server, I > am getting that message in the OSSEC log file. No agents appear to be > able to connect to the server now. Any suggestions or thoughts on > what to look at on the server to fix this? > Make sure all ossec processes are stopped, and try removing the lock file: /var/ossec/queue/ossec/.wait > -- > > --- > You received this message because you are subscribed to the Google > Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
