Hi Sergey,
Is there anything in the server logs? When the agent starts, it sends
a "syn" message
to the server and waits for the reply. However, from your logs, it
looks like ossec-agent
cannot decrypt the reply from the server, so it never starts. Can you
do the following:
-Check if you have more than one instance of the server running (you
checked the
agent already).
-If there is any duplicated Ip address in the client.keys (run manage_agents
and choose to list agents).
*Also, try stopping the server, removing the files at
/var/ossec/queue/rids/, starting
the server again and restarting the agent.
Hope it helps,
--
Daniel B. Cid
dcid ( at ) ossec.net
On 10/27/06, Sergey Zhumatiy <[EMAIL PROTECTED]> wrote:
> Check if you dont have another process of ossec, run ossec-control stop
> and check with ps to be sure
>
The same result :( I had even run 'lsof -i -a |grep 1514' to be sure. No ossec
processes and no connections were leaved. But after ossec start the same errors
were found in logs. And server-side 'list_agents -n' shows this client again...
--
With respect
Serg.
