[Ossec-list] OSSEC seems to die occasionally

[kayvan at sylvan.com (Kayvan A. Sylvan)]

On Tue, Apr 18, 2006 at 09:41:54PM -0300, Daniel Cid wrote:
> Oops. The "analysisd" process dying without a trace is not good. It just
> needs to be able to read from the queue, so permissions on this
> case shouldn't be a problem (it wouldn't even start properly).
> Can you enable system call tracing on the analysisd process? If running
> BSD systems you will probably need to use ktrace -p <analysisd pid>
> or if linux use systrace (systrace -p <analysisd pid>. With that we will
> be able to see what kind of signal (or whatever) is happening.

I am running strace against the OSS analysisd process now. Of course,
this sort of thing is intermittent, so there's no telling when the
problem will manifest again, but I have seen it on two different
machines.

			---Kayvan
-- 
Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89)
http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)