[ossec-list] Re: ossec 1.2 Problems on OpenBSD 4.1-stable

[ddp <ddpbsd@xxxxxxxxx>]

On 7/23/07, Chris Tankersley <chris.tankersley@xxxxxxxxxxxxxxxxx> wrote:
>
>
> CRON TO RESTART OSSEC @ 07/23/07 00:00
> =============================
>
> ossec-monitord not running ..
> ossec-logcollector not running ..
> ossec-syscheckd not running ..
> ossec-analysisd not running ..
> ossec-maild not running ..
> ossec-execd not running ..
> OSSEC HIDS v1.2 Stopped
> Starting OSSEC HIDS v1.2 (by Daniel B. Cid)...
> 2007/07/23 00:00:01 ossec-analysisd(1227): Error applying XML variables: '(bad sequence of commands).'.
> 2007/07/23 00:00:01 ossec-analysisd(1220): Error loading the rules: 'postfix_rules.xml'.
> ossec-analysisd: Configuration error. Exiting
>
>
> CRON TO RESTART OSSEC @ 07/23/07 12:00
> =============================
>
> ossec-monitord not running ..
> ossec-logcollector not running ..
> ossec-syscheckd not running ..
> ossec-analysisd not running ..
> ossec-maild not running ..
> ossec-execd not running ..
> OSSEC HIDS v1.2 Stopped
> Starting OSSEC HIDS v1.2 (by Daniel B. Cid)...
> Started ossec-maild...
> Started ossec-execd...
> Started ossec-analysisd...
> Started ossec-logcollector...
> 2007/07/23 12:00:04 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
> 2007/07/23 12:00:04 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
> 2007/07/23 12:00:12 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
> 2007/07/23 12:00:12 ossec-rootcheck(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
> 2007/07/23 12:00:25 ossec-syscheckd(1210): Queue '/var/ossec/queue/ossec/queue' not accessible: 'Connection refused'.
> 2007/07/23 12:00:25 ossec-rootcheck(1211): Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
>
>

I've had better luck stopping the ossec processes, waiting a second or
two, then starting
them back up.

I'm not running -stable though.

ddp