This is resolved. Added the whitelist ips to ossec.conf, didn't know this was required for an install that doesn't use active defense, and had to add the <remote> section.
On 07/01/2008, Roch <[EMAIL PROTECTED]> wrote: > Just to follow up. If I manually try and run ossec-remoted I get the > segfault again, even with the snapshot version. > > On 07/01/2008, Roch <[EMAIL PROTECTED]> wrote: > > > > Hi, > > > > I installed version 1.4. It never asked me what version of the HIDS I > > wanted to install server/agent etc. So I just went with the defaults. > > > > When it starts up everything seems to be fine but when I do a netstat - > > tupln | grep 1514 > > the required port is not listening. Ossec is definitely started as I > > can see it running in the process list. There are no errors in /var/ > > log/messages or in ossec.log. In version 1.4 it did have a segfault > > error for ossec-remoted but upgrading to the snapshot fixed that it > > seems. > > > > As such none of my agents can communicate with the server. > > > > Also /etc/ossec-init.conf has my Type set to "local", I changed it to > > 'server' and restarted ossec but still no port 1514/udp listening. > > > > I also installed the latest snapshot and have the same issue. > > > > Running Redhat EL-4 64-bit. > > > > Roch > > >
