You're still possibly missing the beginning of the error chain. The
first message there says "socket busy," so something bad has happened.
But we don't know what. It might be useful to figure out which
processes are running on the agent when the error messages start. My
guess is that one of them is
Log message before first ERROR for the agent
2011/01/15 00:05:25 ossec-syscheckd: socket busy ..
2011/01/15 00:05:25 ossec-syscheckd: socketerr (not available).
2011/01/15 00:05:25 ossec-syscheckd(1224): ERROR: Error sending
message to queue.
2011/01/15 00:05:32 ossec-logcollector: socket busy ..
