Dan or anyone else - I see from time to time people reporting issues cause by wrong permissions. Is there any script somewhere to fix/rebuild all OSSEC related files permissions?
On Friday, September 13, 2013 8:06:15 AM UTC-7, [email protected] wrote: > > Thanks Dan. That fixed that issue but now looking at others. Appears > someone has changed ownership of files in the ossec directory structure and > there are still issues which are causing problems with the app including > errors like: > > 2013/09/13 09:30:22 ossec-analysisd: Rules in an inconsistent state. > Exiting. > -and- > 2013/09/13 09:30:30 ossec-logcollector(1224): ERROR: Error sending message > to queue. > 2013/09/13 09:30:33 ossec-logcollector(1210): ERROR: Queue > '/opt/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2013/09/13 09:30:33 ossec-logcollector(1211): ERROR: Unable to access > queue: '/opt/ossec/queue/ossec/queue'. Giving up.. > 2013/09/13 09:31:18 ossec-syscheckd: INFO: Starting syscheck scan > (forwarding database). > 2013/09/13 09:31:18 ossec-syscheckd: socketerr (not available). > 2013/09/13 09:31:18 ossec-syscheckd(1224): ERROR: Error sending message to > queue. > > Why always on a Friday??? ;-) > > > > -----Original Message----- > From: [email protected] <javascript:> [mailto: > [email protected] <javascript:>] On Behalf Of dan (ddp) > Sent: Friday, September 13, 2013 9:16 AM > To: [email protected] <javascript:> > Subject: Re: [ossec-list] "WARN: Process locked. Waiting for permission" > At Server When Trying To Start Server > > On Fri, Sep 13, 2013 at 10:08 AM, MDACC-Luckie > <[email protected]<javascript:>> > wrote: > > I have dealt with issues with agents not connecting to the server with > > a > > "WARN: Process locked. Waiting for permission" message in the log but > > not at the server. When starting OSSEC on the primary OSSEC server, I > > am getting that message in the OSSEC log file. No agents appear to be > > able to connect to the server now. Any suggestions or thoughts on > > what to look at on the server to fix this? > > > > Make sure all ossec processes are stopped, and try removing the lock file: > /var/ossec/queue/ossec/.wait > > > -- > > > > --- > > You received this message because you are subscribed to the Google > > Groups "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > > an email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] <javascript:>. > For more options, visit https://groups.google.com/groups/opt_out. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
