All,
I've been running Ossec and Ossec Web UI on a few of my SuSE 10.2 boxes for a while, and I think its great. Unfortunately, whenever I did a search in the WUI , I would get the header, and the rest of the page was blank. I figured it was something to do with my installation, but hadn't had time to track it down. Today I put debug prints in the search.php until I narrowed it down to a small bit of code to search in. It turned out the script was failing with no errors at the "$USER_searchid = posix_getpid().$curr_time.rand();" line. I looked through my install and found there was a separate package for php5_posix, installed said package, restarted apache, and Blam! It works great now.
I also added "posix support" to the prerequisites page in the wiki.
I added the below to the top of the search.php and it tested out fine. (ie no posix package it fails with error, and with posix package it works fine.)
I'm just not sure the best way to submit this as a patch.
if (!function_exists('posix_getpid'))
{
echo "<b> it appears you have no posix support for php</b><br/>";
return(1);
}