[ossec-list] Re: ossec startup

[Pete <pete42@xxxxxxxxx>]

Thanks for the suggestion Marco.  I don't see anything that would prevent it from starting.  Here's the output (called by 'sh -x /var/ossec/bin/ossec-control start'):

 

# ./S94ossec
+ dirname /var/ossec/bin/ossec-control
LOCAL=/var/ossec/bin
+ cd /var/ossec/bin
+ pwd
PWD=/var/ossec/bin
+ dirname /var/ossec/bin
DIR=/var/ossec
+ cd
NAME=OSSEC HIDS
VERSION=v1.0
AUTHOR=Daniel B. Cid
DAEMONS=ossec-monitord ossec-logcollector ossec-syscheckd ossec-analysisd ossec-maild ossec-execd
LOCK=/var/ossec/var/start-script-lock
LOCK_PID=/var/ossec/var/start-script-lock/pid
MAX_ITERATION=10
+ start
SDAEMONS=ossec-maild ossec-execd ossec-analysisd ossec-logcollector ossec-syscheckd ossec-monitord
+ echo Starting OSSEC HIDS v1.0 (by Daniel B. Cid)...
+ lock
i=0
+ [ 1 ]
+ mkdir /var/ossec/var/start-script-lock
MSL=0
+ [ 0 = 0 ]
+ echo 1177
+ return
+ /var/ossec/bin/ossec-maild -t
+ [ 0 != 0 ]
+ /var/ossec/bin/ossec-execd -t
+ [ 0 != 0 ]
+ /var/ossec/bin/ossec-analysisd -t
+ [ 0 != 0 ]
+ /var/ossec/bin/ossec-logcollector -t
+ [ 0 != 0 ]
+ /var/ossec/bin/ossec-syscheckd -t
+ [ 0 != 0 ]
+ /var/ossec/bin/ossec-monitord -t
+ [ 0 != 0 ]
+ pstatus ossec-maild
pfile=ossec-maild
+ [ Xossec-maild = X ]
+ ls /var/ossec/var/run/ossec-maild*.pid
+ [ 2 = 0 ]
+ return 0
+ [ 0 = 0 ]
+ /var/ossec/bin/ossec-maild
+ [ 0 != 0 ]
+ echo Started ossec-maild...
+ pstatus ossec-execd
pfile=ossec-execd
+ [ Xossec-execd = X ]
+ ls /var/ossec/var/run/ossec-execd*.pid
+ [ 2 = 0 ]
+ return 0
+ [ 0 = 0 ]
+ /var/ossec/bin/ossec-execd
+ [ 0 != 0 ]
+ echo Started ossec-execd...
+ pstatus ossec-analysisd
pfile=ossec-analysisd
+ [ Xossec-analysisd = X ]
+ ls /var/ossec/var/run/ossec-analysisd*.pid
+ [ 2 = 0 ]
+ return 0
+ [ 0 = 0 ]
+ /var/ossec/bin/ossec-analysisd
+ [ 0 != 0 ]
+ echo Started ossec-analysisd...
+ pstatus ossec-logcollector
pfile=ossec-logcollector
+ [ Xossec-logcollector = X ]
+ ls /var/ossec/var/run/ossec-logcollector*.pid
+ [ 2 = 0 ]
+ return 0
+ [ 0 = 0 ]
+ /var/ossec/bin/ossec-logcollector
+ [ 0 != 0 ]
+ echo Started ossec-logcollector...
+ pstatus ossec-syscheckd
pfile=ossec-syscheckd
+ [ Xossec-syscheckd = X ]
+ ls /var/ossec/var/run/ossec-syscheckd*.pid
+ [ 2 = 0 ]
+ return 0
+ [ 0 = 0 ]
+ /var/ossec/bin/ossec-syscheckd
+ [ 0 != 0 ]
+ echo Started ossec-syscheckd...
+ pstatus ossec-monitord
pfile=ossec-monitord
+ [ Xossec-monitord = X ]
+ ls /var/ossec/var/run/ossec-monitord*.pid
+ [ 2 = 0 ]
+ return 0
+ [ 0 = 0 ]
+ /var/ossec/bin/ossec-monitord
+ [ 0 != 0 ]
+ echo Started ossec-monitord...
+ sleep 2
+ unlock
+ rm -rf /var/ossec/var/start-script-lock
+ echo Completed.

 

On 4/13/07, Marco Supino <Marco@xxxxxxxxxxx> wrote:

Can you run the script from rc2 with –x (sh –x <script name>) and send the output, I had similar problems on solaris, but don't remember what the problem was

 

Marco.

 

 

---

From: ossec-list@xxxxxxxxxxxxxxxx [mailto:ossec-list@xxxxxxxxxxxxxxxx] On Behalf Of Pete
Sent: Thursday, April 12, 2007 13:51
To: ossec-list@xxxxxxxxxxxxxxxx
Subject: [ossec-list] Re: ossec startup

 

This is happening in Solaris 9 and Solaris 10.  I've triple-checked the permissions on all the files.  Still no go.

On 4/11/07, Martin West < martin@xxxxxxxxxxxxxxxx> wrote:

What version of solaris?

Martin West