Hi David I can see the agent sending udp packets to the server (agent starting up) but there seems to be no response to them (server not responding), its like the server is totally ignoring the client. I dont get any errors in agent / server logs, the server appears to startup normally and does service the first five agents without a hitch.
The IP addresses check out, no duplicate entries, no errors on keys, tried this many times without firewalls but no success, everything looks painfully normal. Ive tried adding other machines as well but no go. Is there some kind of debug mode for the server Best regards Magnus? -----Original Message----- From: [email protected] on behalf of Daniel Cid Sent: Thu 1/25/2007 3:27 AM To: [email protected] Subject: [ossec-list] Re: agent troubles Hi Magnus, I didn't understand your problem well. What do you mean by "I can see ip traffic from the agent but the server remains silent"? Is your agent getting the "unable to connect" errors in the logs or are you just not seeing any alerts from it? If you do something like a 'logger "Segmentation Fault"' on the agent, do you see any alert on the server? *You will not get any alert if nothing is happening in the agent... *The most common cause of problems is related to authentication keys (wrong IP, or duplicated entry, etc). If the problem is different, try to provide us with more information (like your ossec config, parts of the log, etc) ... Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On 1/24/07, Magnus Egilsson <[EMAIL PROTECTED]> wrote: > > > > > Hi > > > > Has anyone experienced not beeing able to add more than 5 agents to the > server? After restart I can see number six added in the ossec-log. I can see > ip traffic from the agent but the server remains silent. No errors occur in > logs and ive tried this with iptables on and off. The server is running > latest gentoo. > > > > The first five agents are running like a charm and are doing a very good > job.What I find strange is I clone the basic config on agents / server so > everything should be working fine. Client number six is on the same subnet > as the server. > > > > Maybe this is just beginner error since im rather new to ossec :) > > > > Best regards' > > Magnus > > > > > > > > > > > > > > > > > -- > No virus found in this outgoing message. > Checked by AVG Free Edition. > Version: 7.1.410 / Virus Database: 268.17.8/649 - Release Date: 23.1.2007 >
<<inline: winmail.dat>>
