Monitoring Splunk

ossec-analysisd: ERROR: read error

nickbijmoer
Path Finder

Hello guys, I get this error every time, someone knows how to fix it?

ossec-analysisd: ERROR: read error on /queue/diff/server/533/last-entry

Greetings,

Nick

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi Nick,

Please try shutting down OSSEC, deleting that file (/queue/diff/server/533/last-entry), and starting OSSEC back up.

Hope it will work this time. Thanks!
Hunter

View solution in original post

hunters_splunk
Splunk Employee
Splunk Employee

Hi Nick,

Please try shutting down OSSEC, deleting that file (/queue/diff/server/533/last-entry), and starting OSSEC back up.

Hope it will work this time. Thanks!
Hunter

nickbijmoer
Path Finder

I think that worked 🙂 thanks !

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Great - glad know it worked!
Cheers
Hunter

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...