[ossec-dev] Re: ossec-syscheckd and ossec-rootcheck

["Daniel Cid" <dcid@xxxxxxxxx>]

Hi Robert,

The only reader of queue/ossec/queue is analysisd, all ther others are writers.
If analysisd is not running, you will get this "queue" error for all
processes (syscheck, rootcheck, remoted, etc).

Maybe this "ascii" drawing will help understand (ugh):

analysisd (reader) -- queue/ossec/queue
                              /          \
                              |   |   |   |
                           (writers to ossec queue)
                           rootcheck, syscheck, remoted, logcollector


Hope it helps..

--
Daniel B. Cid
dcid ( at ) ossec.net


On 3/21/07, Robert Millan [ackstorm] <rmillan@xxxxxxxxxxx> wrote:
> Hi,
>
> What role do ossec-syscheckd and ossec-rootcheck play in the ossec internal
> design?  It seems they're trying to communicate through a socket, but for
> some reason one of them isn't doing the right thing:
>
> 2007/03/21 11:42:12 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
> 2007/03/21 11:42:12 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
> 2007/03/21 11:42:20 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
> 2007/03/21 11:42:20 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
> 2007/03/21 11:42:33 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: Connection refused.
> 2007/03/21 11:42:33 ossec-rootcheck(1211): Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
>
> $ ls -l /var/ossec/queue/ossec/queue
> srw-rw---- 1 ossec ossec 0 2007-03-21 11:42 /var/ossec/queue/ossec/queue
> $ fuser /var/ossec/queue/ossec/queue
> $ file /var/ossec/queue/ossec/queue
> /var/ossec/queue/ossec/queue: socket
> $
>
> Who is the writer and who is the reader here?  Maybe the reader wasn't there
> when writer attempted to open() or write() ?
>
> Thanks
>
> --
> Robert Millan
>
> ACK STORM, S.L.  -  http://www.ackstorm.es/