ossec / ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
http://www.ossec.net
Other
4.52k stars 1.04k forks source link

ubuntu14 update-upgrade Ossec 3.0 errors #1540

Closed jsandroid1 closed 6 years ago

jsandroid1 commented 6 years ago

Hi everyone

We installed ossec 3.0 using this method http://www.ossec.net/downloads.html#apt-automated-installation-on-ubuntu-and-debian a month ago and everything ran correctly since. Today I have tried to run apt-get update && apt-get upgrade and I have encountered errors regarding ossec.

Preparing to unpack .../ossec-hids-agent_3.0.0-5609trusty_amd64.deb ... Unpacking ossec-hids-agent (3.0.0-5609trusty) over (3.0.0-5607trusty) ... Removing user ossec' ... Warning: groupossec' has no more members. userdel: group ossec is the primary group of another user and is not removed. Done. /usr/sbin/delgroup: ossecm' still hasossec' as their primary group! dpkg: warning: subprocess old post-removal script returned error exit status 7 dpkg: trying script from the new package instead ... /usr/sbin/deluser: The user ossec' does not exist. dpkg: error processing archive /var/cache/apt/archives/ossec-hids-agent_3.0.0-5609trusty_amd64.deb (--unpack): subprocess new post-removal script returned error exit status 2 /usr/sbin/deluser: The userossec' does not exist. dpkg: error while cleaning up: subprocess new post-removal script returned error exit status 2 Processing triggers for man-db (2.6.7.1-1ubuntu1) ... Processing triggers for install-info (5.2.0.dfsg.1-2) ... Processing triggers for ureadahead (0.100.0-16) ... Errors were encountered while processing: /var/cache/apt/archives/ossec-hids-agent_3.0.0-5609trusty_amd64.deb E: Sub-process /usr/bin/dpkg returned an error code (1)

We don't think ossec needed upgrading but as you can see from the output apt-get tried and then failed. We now cannot get ossec working. Has anyone else run into this issue? Any ideas?

Thanks for reading. J

atomicturtle commented 6 years ago

I'm not able to reproduce this here, is it possible you were upgrading an ossec package from a 3rd party?