[ossec-list] Re: re-create queue folders..

2011-10-19 Thread Kat 
it sucked up over 2G and was still running!

On Oct 19, 8:49 pm, dan (ddp) ddp...@gmail.com wrote:
 # ls -l /var/ossec/queue
 total 36
 drwxr-xr-x   2 ossecr  ossec   512 Oct 18 18:56 agent-info
 drwxr-xr-x   2 ossec   ossec   512 Feb 14  2011 agentless
 drwxrwx---   2 ossec   ossec   512 Oct 17 10:22 alerts
 drwxr-x---  10 ossec   ossec   512 Oct 11 09:53 diff
 drwxr-x---   2 ossec   ossec   512 Feb 14  2011 fts
 drwxrwx---   2 ossec   ossec   512 Oct 17 10:22 ossec
 drwxr-xr-x   2 ossecr  ossec   512 Oct 18 18:55 rids
 drwxr-x---   2 ossec   ossec   512 Oct 18 18:57 rootcheck
 drwxr-x---   2 ossec   ossec  1024 Oct 19 17:07 syscheck

 I'm not sure why a large syscheck would have necessitated destroying
 the entire directory. An in place upgrade (rerun install.sh and let it
 upgrade the system) might also work.

[ossec-list] Re: re-create queue folders..

2011-10-19 Thread Kat 
Oh and re-install with Update does not fix it - it won't re-create
the folders, it only copies what it needs to - i.e. UPDATE. And of
course if you tell it NOT to update, you lose your client keys..
*sigh*

Re: [ossec-list] Re: re-create queue folders..

2011-10-19 Thread dan (ddp) 
Is that a lot? I buy in bulk. And I figured some of /var/ossec/queue would
be ok to save. Maybe just get rid of the big files.
On Oct 19, 2011 10:12 PM, Kat uncommon...@gmail.com wrote:

 it sucked up over 2G and was still running!

 On Oct 19, 8:49 pm, dan (ddp) ddp...@gmail.com wrote:
  # ls -l /var/ossec/queue
  total 36
  drwxr-xr-x   2 ossecr  ossec   512 Oct 18 18:56 agent-info
  drwxr-xr-x   2 ossec   ossec   512 Feb 14  2011 agentless
  drwxrwx---   2 ossec   ossec   512 Oct 17 10:22 alerts
  drwxr-x---  10 ossec   ossec   512 Oct 11 09:53 diff
  drwxr-x---   2 ossec   ossec   512 Feb 14  2011 fts
  drwxrwx---   2 ossec   ossec   512 Oct 17 10:22 ossec
  drwxr-xr-x   2 ossecr  ossec   512 Oct 18 18:55 rids
  drwxr-x---   2 ossec   ossec   512 Oct 18 18:57 rootcheck
  drwxr-x---   2 ossec   ossec  1024 Oct 19 17:07 syscheck
 
  I'm not sure why a large syscheck would have necessitated destroying
  the entire directory. An in place upgrade (rerun install.sh and let it
  upgrade the system) might also work.

Re: [ossec-list] Re: re-create queue folders..

2011-10-19 Thread dan (ddp) 
Luckily I gave you most of the info you needed so you didn't have to go
through that.
 On Oct 19, 2011 10:13 PM, Kat uncommon...@gmail.com wrote:

 Oh and re-install with Update does not fix it - it won't re-create
 the folders, it only copies what it needs to - i.e. UPDATE. And of
 course if you tell it NOT to update, you lose your client keys..
 *sigh*