On Thu, Jan 23, 2014 at 11:18 AM, dan (ddp) <[email protected]> wrote: > On Thu, Jan 23, 2014 at 11:10 AM, Ian Martinez <[email protected]> wrote: >> apparently the file exists on /var/ossec/queue/diff/websec/535 >> > > Yep, that makes sense. ossec-analysisd chroots itself (by default to > /var/ossec), so those paths are basically the same. > >> -rw-r-----. 1 ossec ossec 0 Jan 18 13:52 last-entry >> > > I don't have anything to check this against off hand. Reconfiguring > syscheck now.... >
I meant to add that I would try shutting down OSSEC, deleting that file, and starting OSSEC back up. >> looks empty >> >> >> On Thursday, January 23, 2014 10:04:52 AM UTC-6, dan (ddpbsd) wrote: >>> >>> On Thu, Jan 23, 2014 at 11:01 AM, Ian Martinez <[email protected]> >>> wrote: >>> > i keep getting ossec-analysisd: ERROR: read error on >>> > /queue/diff/websec/535/last-entry on my /var/ossec/logs/ossec.log >>> > >>> >>> Does the file exist? Is there content? What are the owner/group and >>> permissions? >>> >>> > any idea why or how to fix the error? >>> > >>> > im on CentOS release 6.5 (Final). >>> > >>> > thanks in advance >>> > >>> > -- >>> > >>> > --- >>> > You received this message because you are subscribed to the Google >>> > Groups >>> > "ossec-list" group. >>> > To unsubscribe from this group and stop receiving emails from it, send >>> > an >>> > email to [email protected]. >>> > For more options, visit https://groups.google.com/groups/opt_out. >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
