OSSEC Agent on 64bit Windows - "Unable to start OSSEC (check config)."

1,424 views
Skip to first unread message

JC

unread,
Jan 26, 2011, 9:10:56 AM1/26/11
to ossec-list
I ran into a minor problem with installing the OSSEC Agent on Windows
2008 64bit.

After successful installation, the agent would not start with the
error, "Unable to start OSSEC (check config)."

I was able to track the problem down to the registry entry:
HKLM\system\currentcontrolset\services\OssecSrv
ImagePath - c:\program files (x86)\ossec-agent\ossec-agent.exe

If you have other directories that start with c:\program...., Windows
may not be able to find the ImagePath specified.

To fix the problem, simply add quotes "c:\program files (x86)\ossec-
agent\ossec-agent.exe"

I am using the deployment process described at http://philipshramko.blogspot.com/
. To automate the change within the msi, I added the following line
to the ossec_distribute_keys_x64.cmd file

Reg ADD HKLM\System\CurrentControlSet\services\OssecSvc /v ImagePath /
t REG_EXPAND_SZ /f /d "\"C:\Program Files (x86)\ossec-agent\ossec-
agent.exe\"
Reply all
Reply to author
Forward
0 new messages