Hi Kat! Yup, seen that happen too.
On Wednesday, August 3, 2016 at 6:56:32 AM UTC-7, Kat wrote: > > One thing to also check is permissions and ownership on "merged.mg" - > many times I see it get mucked up and OSSEC can't read it. I have found > that if I delete it, then restart OSSEC it will be re-created and it no > longer has issues sending the file after that. (Not sure WHY it happens > though) > > Cheers > Kat > > (PS - Hi Graeme!) > > On Thursday, July 28, 2016 at 11:43:32 AM UTC-5, Graeme Stewart wrote: >> >> Seeing a lot of errors in the logfiles like this: >> >> 2016/07/28 16:41:48 ossec-remoted: ERROR: Unable to send file 'merged.mg' >> to agent. >> 2016/07/28 16:41:50 ossec-remoted(1217): ERROR: Error creating encrypted >> message. >> 2016/07/28 16:41:50 ossec-remoted: ERROR: Unable to send file 'merged.mg' >> to agent. >> 2016/07/28 16:41:50 ossec-remoted(1217): ERROR: Error creating encrypted >> message. >> 2016/07/28 16:41:50 ossec-remoted: ERROR: Unable to send file 'merged.mg' >> to agent. >> 2016/07/28 16:41:52 ossec-remoted(1217): ERROR: Error creating encrypted >> message. >> 2016/07/28 16:41:52 ossec-remoted: ERROR: Unable to send file 'merged.mg' >> to agent. >> 2016/07/28 16:41:52 ossec-remoted(1217): ERROR: Error creating encrypted >> message. >> 2016/07/28 16:41:52 ossec-remoted: ERROR: Unable to send file 'merged.mg' >> to agent. >> 2016/07/28 16:41:54 ossec-remoted(1217): ERROR: Error creating encrypted >> message. >> 2016/07/28 16:41:54 ossec-remoted: ERROR: Unable to send file 'merged.mg' >> to agent. >> 2016/07/28 16:41:56 ossec-remoted(1217): ERROR: Error creating encrypted >> message. >> >> Any guidance on troubleshooting? Search hasn't turned up much other than >> delete merged.mg and restart (which we've tried to no success)... >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
