ossec.conf error when starting Wazuh

[Sidney Guidry]

Hello,

currently having an issue with starting wazuh. I made changes to the ossec.conf file started to see the error and reverted the changes. Error still persists.

Error : wazuh-analysisd: CRITICAL: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).

I have checked the permissions as well and everything looks to still be set to the default and haven't been changed.

[Daniel Sappa]

Hi Sydney!

This type of error is generally due to the wrong file format, 

even more so if, as you say, 

you have made modifications.

You can share the ossec.conf, 

before taking into account deleting any data that you consider private, 

please.

[Sidney Guidry]

Hello Daniel,

Attached is the ossec.conf

[Daniel Sappa]

configuration added to the end of the file, from line 365 onwards, must be part of a single

<ossec_config>

...

</ossec_config.

you can see other localfile's settings at line 295 e.g.

Anyway, you can add this new configuration anywhere as long as there is a single <ossec_config> tag.

[Sidney Guidry]

So I didn't add that configuration. But I did move it up so there is only one <ossec_config> and the closing </ossec_config>

It is still giving the same error

[Daniel Sappa]

what is the command you are running?

are you running it as root?

run the following command assuming wazuh-analysisd is not running:

# /var/ossec/bin/wazuh-analysisd -t

tell me what is showing
also send me, please, the ossec.log file.

[Sidney Guidry]

I am using systemd start wazuh-manager 

here is the output for the command, it is the same.

wazuh-analysisd: CRITICAL: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).

[Daniel Sappa]

Hi again Sidney

This behavior is caused by wazuh-analysisd not being able to find the ossec.conf file.

The reasons for this are mainly permissions on the file or on one of the folders where the file is located.
This file should be located, by default, in /var/ossec/etc/ossec.conf and have read permissions for root and group

One test you can do is copy the ossec.conf file to another location, to $HOME e.g. and from there run:

# chmod 666 ~/ossec.conf

#~ /var/ossec/bin/wazuh-analysisd -t -c ~/ossec.conf 

the error message doesn't to be shown.

[Marcelo Osako]

Estou com o mesmo problema, não estou conseguindo resolver. Já acertei as permissões, verifiquei o xml e nada de errado foi encontrado. Isso começou a acontecer depois de uma atualização que fiz no servidor.