> Is there anything in the server logs? When the agent starts, it sends > a "syn" message
Nothig...
> to the server and waits for the reply. However, from your logs, it
> looks like ossec-agent
> cannot decrypt the reply from the server, so it never starts. Can you
> do the following:
>
> -Check if you have more than one instance of the server running (you
> checked the agent already).
Server is running ok, just one instance.
> -If there is any duplicated Ip address in the client.keys (run
> manage_agents and choose to list agents).
>
None.
There were a mgic thing happened yesterday: I had found, that ANOTHER agent
(which was shown by list_agents -c) was not upgraded. After upgrade nothing was
happened (just ossec event 'agent connected'). But about 10 hours later first
agent became normal. It had correctly connected to server and now works OK.
Till theese 10 hours nothing were made with ossec, server and nodes...
Magic?
--
With respect
Serg.
signature.asc
Description: OpenPGP digital signature
