Hello! Since few days, I got lots of message as below in my active-response.log:
Tue Jul 14 09:57:25 CEST 2015 Unable to run (iptables returning != 2): 3 - /var/ossec/active-response/bin/firewall-drop.sh add - <IP / host / reverse> 1436860642.9065736 5551 Tue Jul 14 09:57:25 CEST 2015 Killed process 3322 holding lock. This happen with add and delete action. The problem is that it does not do the add or the delete in that case. Looking what is those processes that have to be killed, I have noticed that almost after each firewall-drop execution, the process becomes a defunct / zombi (keeping the lock). I am not an expert, but it looks like the add /delete issue is due to this defunct. Any idea on how to solve it? Thx in advance! -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
