mikeshinn wrote:
Two things could cause those processes to stop:
1) system ran out of drive space
2) another error caused a shutdown
In the case of 2 (an error caused a shut down), that would be logged in /var/ossec/logs/ossec.log. If the system didnt run out of drive space or inodes, what errors do you see in /var/ossec/logs/ossec.log?
Drive space...
Filesystem Size Used Avail Use% Mounted on
/dev/md1 4.0G 1.1G 2.9G 28% /
devtmpfs 7.8G 0 7.8G 0% /dev
tmpfs 7.9G 84K 7.9G 1% /dev/shm
tmpfs 7.9G 755M 7.1G 10% /run
tmpfs 7.9G 0 7.9G 0% /sys/fs/cgroup
/dev/mapper/vg00-usr 1013G 65G 908G 7% /usr
none 7.9G 6.7M 7.9G 1% /tmp
/dev/mapper/vg00-home 4.8G 37M 4.5G 1% /home
/dev/mapper/vg00-var 202G 22G 173G 11% /var
tmpfs 1.6G 48K 1.6G 1% /run/user/0
Inodes
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/md1 262144 18432 243712 8% /
devtmpfs 2037335 432 2036903 1% /dev
tmpfs 2051911 6 2051905 1% /dev/shm
tmpfs 2051911 912 2050999 1% /run
tmpfs 2051911 16 2051895 1% /sys/fs/cgroup
/dev/mapper/vg00-usr 67436544 325904 67110640 1% /usr
none 2051911 26 2051885 1% /tmp
/dev/mapper/vg00-home 327680 352 327328 1% /home
/dev/mapper/vg00-var 13434880 228289 13206591 2% /var
tmpfs 2051911 12 2051899 1% /run/user/0
ossec.log..
Pages and pages of these..
2018/06/01 14:47:41 ossec-analysisd: ERROR: Invalid integrity message in the database.
(did not find this message in the wiki nor knowledgebase..??)
I guess this would be a starting point... How to fix??