[ossec-dev] ossec-syscheckd and ossec-rootcheck

["Robert Millan [ackstorm]" <rmillan@xxxxxxxxxxx>]

Hi,

What role do ossec-syscheckd and ossec-rootcheck play in the ossec internal
design?  It seems they're trying to communicate through a socket, but for
some reason one of them isn't doing the right thing:

2007/03/21 11:42:12 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
2007/03/21 11:42:12 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
2007/03/21 11:42:20 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
2007/03/21 11:42:20 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
2007/03/21 11:42:33 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
2007/03/21 11:42:33 ossec-rootcheck(1211): Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..

$ ls -l /var/ossec/queue/ossec/queue
srw-rw---- 1 ossec ossec 0 2007-03-21 11:42 /var/ossec/queue/ossec/queue
$ fuser /var/ossec/queue/ossec/queue
$ file /var/ossec/queue/ossec/queue
/var/ossec/queue/ossec/queue: socket
$

Who is the writer and who is the reader here?  Maybe the reader wasn't there
when writer attempted to open() or write() ?

Thanks

-- 
Robert Millan

ACK STORM, S.L.  -  http://www.ackstorm.es/