On Tue, Nov 1, 2016 at 1:49 PM, Eponymous - <[email protected]> wrote: >>> To a process chrooted to /usr/local/ossec-hids, /var/run and >>> /usr/local/ossec-hids/var/run are the same thing. The process' root >>> directory (/) is now /usr/local/ossec-hids. So /usr/local/ossec-hids/var/run >>> looks like /var/run to that process. > > That is very true. > > Hmm, so why is it I get the error: ossec-agentd(1103): ERROR: Unable to open > file '/var/run/.syscheck_run' > when I run without any command line options but then the error disappears > when I specify "-D /usr/local/ossec-hids"? The two instances should result > in the same behaviour? >
No idea, I haven't looked at FreeBSD's port. Perhaps they have it configured to chroot to a directory that doesn't contain var/run? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
