On Tue, Feb 12, 2019 at 11:04 AM Luciano Mannucci <luci...@vespaperitivo.it> wrote: > > > Hello, > > I have an ossec-hids server installed from the freebsd distribution > (ossec-hids-server-3.1.0_1) with a bunch of agents happily running on > varous platforms, all installed via the distribution system. Now I > need to add a freebsd serveer who has no precompiled agent for it is a > PowerPC64, not an intel. I have compiled the agent from the distro > (it says ossec-hids-agent-3.1.0_2), created the agent as usual on the > server, exported the key wich was happily accepted by the PPC agent > and started the service. All seems good but I don't see the client > in the output of list_agents -c (nor in list_agents -n). I see no > errors in the logs, with tcpdump I see some UDP traffic coming from > the agent but no answer: > > 16:30:46.027331 IP 192.168.134.18.58645 > 192.168.134.5.fujitsu-dtcns: UDP, > length 73 > 16:30:52.136911 IP 192.168.134.18.58645 > 192.168.134.5.fujitsu-dtcns: UDP, > length 73 > 16:30:56.157453 IP 192.168.134.18.58645 > 192.168.134.5.fujitsu-dtcns: UDP, > length 73 > 16:31:01.289768 IP 192.168.134.18.58645 > 192.168.134.5.fujitsu-dtcns: UDP, > length 73 > 16:31:07.290754 IP 192.168.134.18.58645 > 192.168.134.5.fujitsu-dtcns: UDP, > length 73 > > Where do I need to look? >
Are you seeing alerts from this agent? Is this agent in /var/ossec/etc/client.keys? > > Thanks in advance, > > Luciano. > -- > /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) > \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 > X AGAINST HTML MAIL / E-MAIL: posthams...@sublink.sublink.org > / \ AND POSTINGS / WWW: http://www.lesassaie.IT/ > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
