On Mon, Mar 17, 2014 at 12:40 PM, Thomas Moretto <[email protected]> wrote: > over the weekend, we were receiving check_ftp socket timeout issues for one > of our web servers. > > ftp was operating just fine and responding exactly as it should in a timely > manner. > > i spent about 2 hours troubleshooting and reviewing logs to find out what > and why was generating this error. > > i finally was able to clear the alert by turning off the ossec agent on that > server. > > what log file can i look at to see what is causing (or even if it is causing > it)? i grepped "/var/ossec/logs/alerts/2014/Mar" to find the error but > nothing was in there. > > any ideas? >
Are you using active response? If so, did you check the active response log? > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
