On Mon, Aug 4, 2014 at 10:56 AM, Tim Boyer <[email protected]> wrote: > > On Monday, August 4, 2014 9:30:26 AM UTC-4, dan (ddpbsd) wrote: >> >> Is there anything useful in ossec.log related to this? Can you >> reproduce this on a recent version of OSSEC? >> >> > > Nothing helpful. Only difference between this startup and a normal startup > is > > 2014/08/04 10:51:48 ossec-syscheckd(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. > 2014/08/04 10:51:48 ossec-rootcheck(1210): ERROR: Queue > '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'. >
Nothing before this? These are a symptom of a failure somewhere. I just tried adding 30ish rules with srcip and didn't have any issues. I'm running post 2.8, and I don't have your exact setup, so this may prove nothing. > Looks like it's time to move to 2.8. Let me see what it will take. > Thanks... > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
