The ossec-remoted unit file requires the forking config otherwise it …

[pgporada]

…dies immediately after a systemctl start ossec-remoted.service

Per https://www.freedesktop.org/software/systemd/man/systemd.service.html

Example 4. Traditional forking services

Many traditional daemons/services background (i.e. fork, daemonize) themselves when starting. Set Type=forking in the service's unit file to support this mode of operation. systemd will consider the service to be in the process of initialization while the original program is still running. Once it exits successfully and at least a process remains (and RemainAfterExit=no), the service is considered started.

Pre-change

# systemctl status ossec-remoted.service                                                                                                           
● ossec-remoted.service - OSSEC remoted
   Loaded: loaded (/usr/lib/systemd/system/ossec-remoted.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since Tue 2017-04-25 20:38:32 UTC; 3s ago
  Process: 19192 ExecStart=/usr/bin/env ${DIRECTORY}/bin/ossec-remoted -f -ddd (code=exited, status=0/SUCCESS)
  Process: 19175 ExecStartPre=/usr/bin/env ${DIRECTORY}/bin/ossec-remoted -t (code=exited, status=0/SUCCESS)
 Main PID: 19192 (code=exited, status=0/SUCCESS)

Apr 25 20:38:32 myserver systemd[1]: Starting OSSEC remoted...
Apr 25 20:38:32 myserver systemd[1]: Started OSSEC remoted.
Apr 25 20:38:32 myserver env[19192]: 2017/04/25 20:38:32 ossec-remoted: DEBUG: Starting ...
Apr 25 20:38:32 myserver env[19192]: 2017/04/25 20:38:32 ossec-remoted: INFO: Started (pid: 19192).
Apr 25 20:38:32 myserver env[19192]: 2017/04/25 20:38:32 ossec-remoted: DEBUG: Forking remoted: '0'.
Apr 25 20:38:32 myserver env[19192]: 2017/04/25 20:38:32 ossec-remoted: INFO: Started (pid: 19200).
Apr 25 20:38:32 myserver env[19192]: 2017/04/25 20:38:32 ossec-remoted(1225): INFO: SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...

Post change

# systemctl status ossec-remoted.service 
● ossec-remoted.service - OSSEC remoted
   Loaded: loaded (/usr/lib/systemd/system/ossec-remoted.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2017-04-25 20:42:14 UTC; 19min ago
 Main PID: 19425 (ossec-remoted)
   CGroup: /system.slice/ossec-remoted.service
           └─19425 /var/ossec/bin/ossec-remoted -f

Apr 25 20:42:14 myserver systemd[1]: Starting OSSEC remoted...
Apr 25 20:42:14 myserver env[19423]: 2017/04/25 20:42:14 ossec-remoted: INFO: Started (pid: 19423).
Apr 25 20:42:14 myserver systemd[1]: Started OSSEC remoted.
Apr 25 20:42:14 myserver env[19423]: 2017/04/25 20:42:14 ossec-remoted: INFO: Started (pid: 19425).
Apr 25 20:42:14 myserver env[19423]: 2017/04/25 20:42:14 ossec-remoted(4111): INFO: Maximum number of agents allowed: '16384'.
Apr 25 20:42:14 myserver env[19423]: 2017/04/25 20:42:14 ossec-remoted(1410): INFO: Reading authentication keys file.
Apr 25 20:42:14 myserver env[19423]: 2017/04/25 20:42:14 ossec-remoted: INFO: Assigning counter for agent someagentserver...0:3280'.
Apr 25 20:42:14 myserver env[19423]: 2017/04/25 20:42:14 ossec-remoted: INFO: Assigning sender counter: 0:191
Hint: Some lines were ellipsized, use -l to show in full.

---

This change is 

[ddpbsd]

Thanks for the patch!
It looks like I included that when trying to update the systemctl stuff in my PR #895
I'm guessing you have more systemd experience than me, so if you could checkout that PR, it'd really help.

[pgporada]

@ddpbsd I can be an extra set of eyes, not a problem at all. I've got a question for you though. Do you prefer questions about OSSEC to be asked on the mailing list or via Github issues?

[atomicturtle]

In github is the best place for it, anything in here always is at the top of the list!

[ddpbsd]

@atomicturtle and Imightdisagree. :-)
I prefer the mailing list for non-code related things. If it's general support (setup help, AR help, etc), the mailing list is a treasure trove of information, and I'd like the archives to be a good place to go for help.

If it's more code related, github is a great place to post.

I spend more time in email than I do on github though, so I'm biased. But plenty of people post here as well, so I'm getting used to it.