We ran into an issue with the test build that is very similar to:viewtopic.php?f=3&t=4000
The issue appears to have started when we upgraded to the ossec 2.6 rpm.
After looking at the errors generated, we found that we were missing the asl decoder file at:
Since this is a test box we didn't have another copy of 01-asl-decoder.xml so we used the file from our 2.x ASL install from our other box.
After putting said file in the above folder and in /var/ossec/etc/decoder.d/ we were able to restore OSSEC functionality.
Have you had any recent reports of similar issues?
Where can we get the default 01-asl-decoder.xml latest file from so that we aren't running with the 2.0 version (assuming there have been some changes since then)?