ok
root@lenga # date
Thursday, February 27, 2014 18:05:02 PM CLST
root@lenga # /var/ossec/bin/ossec-execd
root@lenga # /var/ossec/bin/ossec-agentd
root@lenga # /var/ossec/bin/ossec-logcollector
root@lenga # /var/ossec/bin/ossec-control status
ossec-logcollector: Process 12105 not used by ossec, removing ..
ossec-logcollector not running...
ossec-syscheckd not running...
ossec-agentd not running...
ossec-execd is running...
root@lenga # tail -f ../logs/ossec.log
2014/02/27 18:02:23 ossec-rootcheck(1210): ERROR: Queue
'/var/ossec/queue/ossec/queue' not accessible: 'Destination address
required'.
2014/02/27 18:02:36 ossec-syscheckd(1210): ERROR: Queue
'/var/ossec/queue/ossec/queue' not accessible: 'Destination address
required'.
2014/02/27 18:02:36 ossec-rootcheck(1211): ERROR: Unable to access queue:
'/var/ossec/queue/ossec/queue'. Giving up..
2014/02/27 18:03:12 ossec-execd: INFO: Started (pid: 11986).
2014/02/27 18:03:28 ossec-execd: INFO: Started (pid: 11991).
2014/02/27 18:03:48 ossec-logcollector(1210): ERROR: Queue
'/var/ossec/queue/ossec/queue' not accessible: 'Destination address
required'.
2014/02/27 18:03:48 ossec-logcollector(1211): ERROR: Unable to access
queue: '/var/ossec/queue/ossec/queue'. Giving up..
2014/02/27 18:05:22 ossec-execd: INFO: Started (pid: 12099).
2014/02/27 18:05:37 ossec-logcollector(1210): ERROR: Queue
'/var/ossec/queue/ossec/queue' not accessible: 'Destination address
required'.
2014/02/27 18:05:37 ossec-logcollector(1211): ERROR: Unable to access
queue: '/var/ossec/queue/ossec/queue'. Giving up..
root@lenga #
root@lenga # ps -fea | grep ossec | grep -v grep
root 11972 1 0 18:02:13 ? 0:00
/var/ossec/bin/ossec-execd
root 12099 1 0 18:05:22 ? 0:00
/var/ossec/bin/ossec-execd
root 11986 1 0 18:03:12 ? 0:00
/var/ossec/bin/ossec-execd
root 11991 1 0 18:03:29 ? 0:00
/var/ossec/bin/ossec-execd
this daemons running with something parameters?
thanks for your help
El miércoles, 26 de febrero de 2014 15:19:20 UTC-3, dan (ddpbsd) escribió:
>
> On Wed, Feb 26, 2014 at 1:04 PM, OsO Roñoso <[email protected]<javascript:>>
> wrote:
> > Hi,
> >
> > i have a problem with install agent on Solaris 10, i read in other
> forum
> > but witout more success, somebody have any idea? ( the same agent in
> windows
> > and linux works fine )
> >
> > root@lenga # /var/ossec/bin/ossec-control start
> > Starting OSSEC HIDS v2.7.1 (by Trend Micro Inc.)...
> > Deleting PID file '/var/ossec/var/run/ossec-logcollector-6253.pid' not
> > used...
> > ossec-execd already running...
> > Started ossec-agentd...
> > Started ossec-logcollector...
>
> Try starting these 2 daemons manually, see if there are any extra or
> interesting logs to ossec.log.
>
> > 2014/02/26 14:36:02 ossec-syscheckd(1210): ERROR: Queue
> > '/var/ossec/queue/ossec/queue' not accessible: 'Destination address
> > required'.
> > 2014/02/26 14:36:02 ossec-rootcheck(1210): ERROR: Queue
> > '/var/ossec/queue/ossec/queue' not accessible: 'Destination address
> > required'.
> > 2014/02/26 14:36:10 ossec-syscheckd(1210): ERROR: Queue
> > '/var/ossec/queue/ossec/queue' not accessible: 'Destination address
> > required'.
> > 2014/02/26 14:36:10 ossec-rootcheck(1210): ERROR: Queue
> > '/var/ossec/queue/ossec/queue' not accessible: 'Destination address
> > required'.
> > 2014/02/26 14:36:23 ossec-syscheckd(1210): ERROR: Queue
> > '/var/ossec/queue/ossec/queue' not accessible: 'Destination address
> > required'.
> > 2014/02/26 14:36:23 ossec-rootcheck(1211): ERROR: Unable to access
> queue:
> > '/var/ossec/queue/ossec/queue'. Giving up..
> > ossec-syscheckd did not start
> >
> >
> > root@lenga # ls -las
> > total 4
> > 2 drwxrwx--- 2 root root 512 Feb 26 14:31 .
> > 2 dr-xr-x--- 7 root root 512 Feb 25 18:26 ..
> > 0 -rw-r--r-- 1 root root 0 Feb 25 18:34 .agent_info
> <----
> > i changed own for ossec and root, same problem
> > 0 srw-rw---- 1 ossec ossec 0 Feb 25 18:34 queue
> >
> > If you need more details please let me know
> >
> > best regards
> >
>
> Can you provide the ossec.conf for this agent?
>
> >
> >
> >
> >
> > --
> >
> > ---
> > You received this message because you are subscribed to the Google
> Groups
> > "ossec-list" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an
> > email to [email protected] <javascript:>.
> > For more options, visit https://groups.google.com/groups/opt_out.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
