var/ossec/var/start-script-lock/pid: No such file or directory

1,031 views
Skip to first unread message

Aj Navarro

unread,
May 23, 2016, 1:18:54 PM5/23/16
to Wazuh mailing list
what happened here when I stop and start ossec?
 
 
[root@ixtrtc42scf ~]# /var/ossec/bin/ossec-control stop
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
/var/ossec/bin/ossec-control: line 89: /var/ossec/var/start-script-lock/pid: No such file or directory
ossec-monitord not running ..
ossec-logcollector not running ..
ossec-syscheckd not running ..
ossec-analysisd not running ..
ossec-maild not running ..
ossec-execd not running ..
ossec-csyslogd not running ..
OSSEC HIDS v2.8.3 Stopped
[root@ixtrtc42scf ~]#
[root@ixtrtc42scf ~]#
[root@ixtrtc42scf ~]#
[root@ixtrtc42scf ~]# /var/ossec/bin/ossec-control start
Starting OSSEC HIDS v2.8.3 (by Trend Micro Inc.)...
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
cat: /var/ossec/var/start-script-lock/pid: No such file or directory
/var/ossec/bin/ossec-control: line 89: /var/ossec/var/start-script-lock/pid: No such file or directory
Started ossec-csyslogd...
2016/05/23 12:13:25 ossec-maild: INFO: E-Mail notification disabled. Clean Exit.
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-syscheckd...
Started ossec-monitord...
Completed.

Santiago Bassett

unread,
May 23, 2016, 5:05:30 PM5/23/16
to Aj Navarro, Wazuh mailing list
That file is created and deleted by ossec-control script. Does it have permissions to create the directory/file? Could you try creating it manually?

See relevant code below:




--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/c534e324-9103-48fd-9b52-57aea132c2d5%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Adiel Navarro

unread,
May 23, 2016, 5:13:14 PM5/23/16
to Santiago Bassett, Aj Navarro, Wazuh mailing list

Hi Santiago.

 

This file not existing and the error not appear again.

 

But in ossec.log I see the next error:

ERROR: read error on /queue/diff/ixtrtc42scf/535/last-entry

 

What it means?

Santiago Bassett

unread,
May 23, 2016, 5:20:18 PM5/23/16
to Adiel Navarro, Aj Navarro, Wazuh mailing list
Probably the file was a temporary one. I wouldn't worry about it.

Regarding the new error how often do you see it? It seems to be related to report_changes option when monitoring files for changes.

I hope it helps,

Santiago.

Adiel Navarro

unread,
May 23, 2016, 5:33:32 PM5/23/16
to Santiago Bassett, Wazuh mailing list

I see this error from today.

The file exists.

 

[root@ixtrtc42scf rules]# cd /var/ossec/queue/diff/ixtrtc42scf/535

[root@ixtrtc42scf 535]# ls -lrt

total 0

-rw-r----- 1 ossec ossec 0 May 23 12:00 last-entry

Santiago Bassett

unread,
May 23, 2016, 5:45:08 PM5/23/16
to Adiel Navarro, Wazuh mailing list
Answered in the other email thread.
Reply all
Reply to author
Forward
0 new messages