[ossec-list] Re: remoted Dropping Events

2016-12-09 Thread Chris Decker
Dave, Thanks for your suggestions. If I start remoted manually it doesn't complain that the port is already in use. I am also starting it in debug mode and its starts cleanly AND works when I start it manually. I *do* have remoted configured to accept both tcp and udp logs on port 514, but

[ossec-list] Re: remoted Dropping Events

2016-12-09 Thread Dave Stoddard
If remoted is failing, it is likely you have another program running on that port that remoted is trying to bind to. For example, syslog is a common application on UNIX/BSD/Linux systems, and uses port 514. If you also attempt to use port 514 for remoted, you will get a conflict and remoted