https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250647#M6665 <P>Hello guys, I get this error every time, someone knows how to fix it?</P> <P>ossec-analysisd: ERROR: read error on /queue/diff/<EM>server</EM>/533/last-entry</P> <P>Greetings,</P> <P>Nick</P> Tue, 11 Oct 2016 09:15:01 GMT nickbijmoer 2016-10-11T09:15:01Z https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250647#M6665 <P>Hello guys, I get this error every time, someone knows how to fix it?</P> <P>ossec-analysisd: ERROR: read error on /queue/diff/<EM>server</EM>/533/last-entry</P> <P>Greetings,</P> <P>Nick</P> Tue, 11 Oct 2016 09:15:01 GMT https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250647#M6665 nickbijmoer 2016-10-11T09:15:01Z https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250648#M6666 <P>Hi Nick, </P> <P>Please try shutting down OSSEC, deleting that file (/queue/diff/server/533/last-entry), and starting OSSEC back up. </P> <P>Hope it will work this time. Thanks!<BR /> Hunter</P> Tue, 11 Oct 2016 13:37:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250648#M6666 hunters_splunk 2016-10-11T13:37:41Z https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250649#M6667 <P>I think that worked <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> thanks !</P> Tue, 11 Oct 2016 14:10:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250649#M6667 nickbijmoer 2016-10-11T14:10:07Z https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250650#M6668 <P>Great - glad know it worked! <BR /> Cheers<BR /> Hunter</P> Tue, 11 Oct 2016 14:13:32 GMT https://community.splunk.com/t5/Monitoring-Splunk/ossec-analysisd-ERROR-read-error/m-p/250650#M6668 hunters_splunk 2016-10-11T14:13:32Z