Hi Martin,
I had this problem before when I misconfigured the keys for the agents. Can you make sure that the first agent, really has the right key on it ( that matches his ip address)? Also, make sure that iptables is not blocking port 1514... *I don't think that the zlib version is the problem... *do an ifconfig on the agent and look at /var/ossec/etc/client.keys to make sure that the IP address is correct in there. If that does not fix the problem, can you show us the following files: *for both server and agents: /var/ossec/etc/ossec.conf /var/ossec/logs/ossec.log /var/ossec/etc/client.keys (change the secret key before posting) ifconfig -a iptables -vL Hope it helps.. -- Daniel B. Cid dcid ( at ) ossec.net On 8/3/06, Martin Gottlieb <[EMAIL PROTECTED]> wrote:
Hello, I am trying to set up a new install of OSSEC and am having difficulty getting the agents to communicate with the server. All machines have port 1514 open and I have added the agent machines' ip addresses to the server config (using <allowed-ips> ) and generated and imported new authentication keys on each Agent. In the server log, I am seeing lots of messages like this: 2006/08/03 13:57:54 ossec-remoted(2202): Error uncompressing string. Are there any dependencies on the versions of zlib ? My Server is running Fedora Core release 4 (Stentz), which has zlib version zlib-1.2.2.2-5.fc4 One Agent is running RH7.3 with zlib 1.1.4-8.7x and another is running RH ES 3 with zlib 1.1.4-8.1 The first agent is logging errors like: 2006/08/03 13:13:23 ossec-agentd(1218): Unable to send message to server. while the other agent is not logging any errors at all. Any ideas ? Sorry if I've omitted any pertinent info, I'll be happy to provide additional config info if it would be helpful. Thanks. Martin
