I ran into a minor problem with installing the OSSEC Agent on Windows
2008 64bit.
After successful installation, the agent would not start with the
error, "Unable to start OSSEC (check config)."
I was able to track the problem down to the registry entry:
HKLM\system\currentcontrolset\services\OssecSrv
ImagePath - c:\program files (x86)\ossec-agent\ossec-agent.exe
If you have other directories that start with c:\program...., Windows
may not be able to find the ImagePath specified.
To fix the problem, simply add quotes "c:\program files (x86)\ossec-
agent\ossec-agent.exe"
I am using the deployment process described at
http://philipshramko.blogspot.com/
. To automate the change within the msi, I added the following line
to the ossec_distribute_keys_x64.cmd file
Reg ADD HKLM\System\CurrentControlSet\services\OssecSvc /v ImagePath /
t REG_EXPAND_SZ /f /d "\"C:\Program Files (x86)\ossec-agent\ossec-
agent.exe\"