If Roy is in a situation like me, I have no clue which files had permissions/ownership changed on them so am having to back into everything step by step. I now know who and when they were changed but at the moment, that and a couple of bucks will only get me a cup of coffee..lol (trying to make myself smile through it all).
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: Friday, September 13, 2013 12:38 PM To: [email protected] Subject: Re: [ossec-list] "WARN: Process locked. Waiting for permission" At Server When Trying To Start Server On Fri, Sep 13, 2013 at 1:36 PM, Roy Feintuch <[email protected]> wrote: > Dan or anyone else - I see from time to time people reporting issues > cause by wrong permissions. > Is there any script somewhere to fix/rebuild all OSSEC related files > permissions? > Not that I know of. If you let us know which files you keep changing the permissions on, we can probably create something. > > On Friday, September 13, 2013 8:06:15 AM UTC-7, [email protected] wrote: >> >> Thanks Dan. That fixed that issue but now looking at others. >> Appears someone has changed ownership of files in the ossec directory >> structure and there are still issues which are causing problems with >> the app including errors like: >> >> 2013/09/13 09:30:22 ossec-analysisd: Rules in an inconsistent state. >> Exiting. >> -and- >> 2013/09/13 09:30:30 ossec-logcollector(1224): ERROR: Error sending >> message to queue. >> 2013/09/13 09:30:33 ossec-logcollector(1210): ERROR: Queue >> '/opt/ossec/queue/ossec/queue' not accessible: 'Connection refused'. >> 2013/09/13 09:30:33 ossec-logcollector(1211): ERROR: Unable to access >> queue: '/opt/ossec/queue/ossec/queue'. Giving up.. >> 2013/09/13 09:31:18 ossec-syscheckd: INFO: Starting syscheck scan >> (forwarding database). >> 2013/09/13 09:31:18 ossec-syscheckd: socketerr (not available). >> 2013/09/13 09:31:18 ossec-syscheckd(1224): ERROR: Error sending >> message to queue. >> >> Why always on a Friday??? ;-) >> >> >> >> -----Original Message----- >> From: [email protected] [mailto:[email protected]] On >> Behalf Of dan (ddp) >> Sent: Friday, September 13, 2013 9:16 AM >> To: [email protected] >> Subject: Re: [ossec-list] "WARN: Process locked. Waiting for permission" >> At Server When Trying To Start Server >> >> On Fri, Sep 13, 2013 at 10:08 AM, MDACC-Luckie <[email protected]> wrote: >> > I have dealt with issues with agents not connecting to the server >> > with a >> > "WARN: Process locked. Waiting for permission" message in the log >> > but not at the server. When starting OSSEC on the primary OSSEC >> > server, I am getting that message in the OSSEC log file. No agents >> > appear to be able to connect to the server now. Any suggestions or >> > thoughts on what to look at on the server to fix this? >> > >> >> Make sure all ossec processes are stopped, and try removing the lock file: >> /var/ossec/queue/ossec/.wait >> >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, >> > send an email to [email protected]. >> > For more options, visit https://groups.google.com/groups/opt_out. >> >> -- >> >> --- >> You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, >> send an email to [email protected]. >> For more options, visit https://groups.google.com/groups/opt_out. > > -- > > --- > You received this message because you are subscribed to the Google > Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
