Ossec nothing returned error

Question

When searching in the Ossec server for the report, it is showing nothing returned (or search expired). What's this error?

Answer 1

/var/log/apache2/error.log showed that a tmp directory was missing in the Ossec root directory

fopen(./tmp/output-tmp.1-121-740837e5692760ab1b2d8337c56a7132.php): failed to open stream: No such file or directory in /var/www/ossec-wui-0.9/lib/os_lib_alerts.php on line 39

Created a tmp directory in /var/www/ossec-wui-0.9

Changed ownership to www-data

Restarted apache

Issue Fixed. Search results showing now.