On Wed, Oct 2, 2013 at 9:39 AM, Ford,Luckie J <[email protected]> wrote: > Sorry.... not sure I understand your statement " So for > /opt/ossec/queue/ossec to exist you'd need /opt/ossec/opt/ossec/queue/ossec ". >
The process has been chrooted to /opt/ossec. The process is looking for /queue/ossec, because /opt/ossec is the new / for that process. If the process thought it was looking for /opt/ossec/queue/ossec, it would actually be looking for /opt/ossec/opt/ossec/queue/ossec. chroot, it's like a wacky drug. > Because of requirements at our facility, ossec is installed in /opt/ossec > instead of /var/ossec. When doing a : > > ossec-remoted -df > > The results are: > > 2013/09/30 11:08:46 ossec-remoted: DEBUG: Starting ... > 2013/09/30 11:08:46 ossec-remoted: INFO: Started (pid: 12020). > [root@dcprpoemprddb1 logs]# 2013/09/30 11:08:46 ossec-remoted: DEBUG: Forking > remoted: '0'. > 2013/09/30 11:08:46 ossec-remoted: INFO: Started (pid: 12021). > 2013/09/30 11:08:46 ossec-remoted: DEBUG: Running manager_init > 2013/09/30 11:08:49 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2013/09/30 11:08:49 ossec-remoted(1211): ERROR: Unable to access queue: > '/queue/ossec/queue'. Giving up.. > > Are the paths shown in the last two lines of that message accurate based on > my install directory of /opt/ossec. If so, what should the permissions be > and any other thoughts on why I might be getting those errors? If not, what > would cause it to use that path and where/how do I correct it? > Read up on chroot. I gave you the permissions already. Are all of the other necessary processes running? > > > . > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
