Looks liked it work! Deleted the file and no longer shows the error. ill keep a close watch on it though.
Thank you for your time. On Thursday, January 23, 2014 10:19:20 AM UTC-6, dan (ddpbsd) wrote: > > On Thu, Jan 23, 2014 at 11:18 AM, dan (ddp) <[email protected]<javascript:>> > wrote: > > On Thu, Jan 23, 2014 at 11:10 AM, Ian Martinez > > <[email protected]<javascript:>> > wrote: > >> apparently the file exists on /var/ossec/queue/diff/websec/535 > >> > > > > Yep, that makes sense. ossec-analysisd chroots itself (by default to > > /var/ossec), so those paths are basically the same. > > > >> -rw-r-----. 1 ossec ossec 0 Jan 18 13:52 last-entry > >> > > > > I don't have anything to check this against off hand. Reconfiguring > > syscheck now.... > > > > I meant to add that I would try shutting down OSSEC, deleting that > file, and starting OSSEC back up. > > >> looks empty > >> > >> > >> On Thursday, January 23, 2014 10:04:52 AM UTC-6, dan (ddpbsd) wrote: > >>> > >>> On Thu, Jan 23, 2014 at 11:01 AM, Ian Martinez <[email protected]> > >>> wrote: > >>> > i keep getting ossec-analysisd: ERROR: read error on > >>> > /queue/diff/websec/535/last-entry on my /var/ossec/logs/ossec.log > >>> > > >>> > >>> Does the file exist? Is there content? What are the owner/group and > >>> permissions? > >>> > >>> > any idea why or how to fix the error? > >>> > > >>> > im on CentOS release 6.5 (Final). > >>> > > >>> > thanks in advance > >>> > > >>> > -- > >>> > > >>> > --- > >>> > You received this message because you are subscribed to the Google > >>> > Groups > >>> > "ossec-list" group. > >>> > To unsubscribe from this group and stop receiving emails from it, > send > >>> > an > >>> > email to [email protected]. > >>> > For more options, visit https://groups.google.com/groups/opt_out. > >> > >> -- > >> > >> --- > >> You received this message because you are subscribed to the Google > Groups > >> "ossec-list" group. > >> To unsubscribe from this group and stop receiving emails from it, send > an > >> email to [email protected] <javascript:>. > >> For more options, visit https://groups.google.com/groups/opt_out. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
