[ossec-dev] Re: ossec-syscheckd and ossec-rootcheck

["Daniel Cid" <dcid@xxxxxxxxx>]

Hi Robert,

I thought you were talking about the server. On the agent side, "agentd" is the
only reader (it forwards everything to the server).

Hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 3/23/07, Robert Millan [ackstorm] <rmillan@xxxxxxxxxxx> wrote:
> On Thu, Mar 22, 2007 at 08:41:13PM -0400, Daniel Cid wrote:
> > Hi Robert,
> >
> > The only reader of queue/ossec/queue is analysisd, all ther others are
> > writers.
> > If analysisd is not running, you will get this "queue" error for all
> > processes (syscheck, rootcheck, remoted, etc).
> >
> > Maybe this "ascii" drawing will help understand (ugh):
> >
> > analysisd (reader) -- queue/ossec/queue
> >                               /          \
> >                               |   |   |   |
> >                            (writers to ossec queue)
> >                            rootcheck, syscheck, remoted, logcollector
>
> Ah, I see.  It seems that analisysd is not installed at all when you select
> "agent" setup.  Should it be also present in the agent systems then?
>
> --
> Robert Millan
>
> ACK STORM, S.L.  -  http://www.ackstorm.es/