[ossec-list] ossec 1.2 Problems on OpenBSD 4.1-stable

[Chris Tankersley <chris.tankersley@xxxxxxxxxxxxxxxxx>]

We were having problems with ossec just stopping on OpenBSD 4.1-stable, 
so we set up a cron to stop, then start the ossec server every 12 hours. 
Starting on Friday, we started getting e-mails from the cron service 
about ossec not starting correctly, or not running when it goes to shut 
off. I've put the cron alerts below.

Has anyone else had issues running Ossec on OpenBSD 4.1-stable? Our 
Linux boxes running it never have an issue and have been solid.

Chris

CRON TO RESTART OSSEC @ 07/22/07 00:00
=============================

Killing ossec-monitord .. 
Killing ossec-logcollector .. 
Killing ossec-syscheckd .. 
Killing ossec-analysisd .. 
Killing ossec-maild .. 
Killing ossec-execd .. 
OSSEC HIDS v1.2 Stopped
Starting OSSEC HIDS v1.2 (by Daniel B. Cid)...
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-syscheckd...
Started ossec-monitord...
Completed.


CRON TO RESTART OSSEC @ 07/22/07 12:00
=============================

Killing ossec-monitord .. 
Killing ossec-logcollector .. 
Killing ossec-syscheckd .. 
Killing ossec-analysisd .. 
Killing ossec-maild .. 
Killing ossec-execd .. 
OSSEC HIDS v1.2 Stopped
Starting OSSEC HIDS v1.2 (by Daniel B. Cid)...
2007/07/22 12:00:02 ossec-analysisd(1227): Error applying XML variables: 'Grouping of the postfix rules.'.
2007/07/22 12:00:02 ossec-analysisd(1220): Error loading the rules: 'postfix_rules.xml'.
ossec-analysisd: Configuration error. Exiting


CRON TO RESTART OSSEC @ 07/23/07 00:00
=============================

ossec-monitord not running ..
ossec-logcollector not running ..
ossec-syscheckd not running ..
ossec-analysisd not running ..
ossec-maild not running ..
ossec-execd not running ..
OSSEC HIDS v1.2 Stopped
Starting OSSEC HIDS v1.2 (by Daniel B. Cid)...
2007/07/23 00:00:01 ossec-analysisd(1227): Error applying XML variables: '(bad sequence of commands).'.
2007/07/23 00:00:01 ossec-analysisd(1220): Error loading the rules: 'postfix_rules.xml'.
ossec-analysisd: Configuration error. Exiting


CRON TO RESTART OSSEC @ 07/23/07 12:00
=============================

ossec-monitord not running ..
ossec-logcollector not running ..
ossec-syscheckd not running ..
ossec-analysisd not running ..
ossec-maild not running ..
ossec-execd not running ..
OSSEC HIDS v1.2 Stopped
Starting OSSEC HIDS v1.2 (by Daniel B. Cid)...
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
2007/07/23 12:00:04 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2007/07/23 12:00:04 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2007/07/23 12:00:12 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2007/07/23 12:00:12 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2007/07/23 12:00:25 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
2007/07/23 12:00:25 ossec-rootcheck(1211): Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..




-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.