root@<myhost>:/var/ossec # tail logs/ossec.log 2020/08/13 12:59:22 ossec-syscheckd: INFO: (6206): Ignore 'file' entry '/var/ossec/var' 2020/08/13 12:59:22 ossec-syscheckd: INFO: (6206): Ignore 'file' entry '/var/ossec/tmp' 2020/08/13 12:59:22 ossec-syscheckd: INFO: (6206): Ignore 'file' entry '/var/ossec/stats' 2020/08/13 12:59:22 ossec-syscheckd: INFO: (6207): Ignore 'file' sregex '.log$|.swp$' 2020/08/13 12:59:22 ossec-syscheckd: ERROR: Couldn't create SQLite database '/var/ossec/queue/fim/db/fim.db': unable to open database file 2020/08/13 12:59:22 ossec-syscheckd: CRITICAL: (6698): Creating Data Structure: sqlite3 db. Exiting. 2020/08/13 12:59:51 ossec-agentd: INFO: Agent is restarting due to shared configuration changes. 2020/08/13 12:59:52 ossec-agentd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2020/08/13 12:59:52 ossec-execd: INFO: (1314): Shutdown received. Deleting responses. 2020/08/13 12:59:52 ossec-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... Creating the directory solves this problem: mkdir -p /var/ossec/queue/fim/db chown -R ossec:ossec /var/ossec/queue/fim So I guess this could be done by the package itself. Will send a patch.
Dear Felipe, Thanks for your report, I was on vacation. Do you plan to send a patch or shall I fix this in Makefile? Best, Michael
Created attachment 217535 [details] fix folder Enclosed a patch for the reported error