One thing to also check is permissions and ownership on "merged.mg" - many times I see it get mucked up and OSSEC can't read it. I have found that if I delete it, then restart OSSEC it will be re-created and it no longer has issues sending the file after that. (Not sure WHY it happens though)
Cheers Kat (PS - Hi Graeme!) On Thursday, July 28, 2016 at 11:43:32 AM UTC-5, Graeme Stewart wrote: > > Seeing a lot of errors in the logfiles like this: > > 2016/07/28 16:41:48 ossec-remoted: ERROR: Unable to send file 'merged.mg' > to agent. > 2016/07/28 16:41:50 ossec-remoted(1217): ERROR: Error creating encrypted > message. > 2016/07/28 16:41:50 ossec-remoted: ERROR: Unable to send file 'merged.mg' > to agent. > 2016/07/28 16:41:50 ossec-remoted(1217): ERROR: Error creating encrypted > message. > 2016/07/28 16:41:50 ossec-remoted: ERROR: Unable to send file 'merged.mg' > to agent. > 2016/07/28 16:41:52 ossec-remoted(1217): ERROR: Error creating encrypted > message. > 2016/07/28 16:41:52 ossec-remoted: ERROR: Unable to send file 'merged.mg' > to agent. > 2016/07/28 16:41:52 ossec-remoted(1217): ERROR: Error creating encrypted > message. > 2016/07/28 16:41:52 ossec-remoted: ERROR: Unable to send file 'merged.mg' > to agent. > 2016/07/28 16:41:54 ossec-remoted(1217): ERROR: Error creating encrypted > message. > 2016/07/28 16:41:54 ossec-remoted: ERROR: Unable to send file 'merged.mg' > to agent. > 2016/07/28 16:41:56 ossec-remoted(1217): ERROR: Error creating encrypted > message. > > Any guidance on troubleshooting? Search hasn't turned up much other than > delete merged.mg and restart (which we've tried to no success)... > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
