What do I need to have opened up between the Server and the Agents for the Server to be able to communicate to the Agents.
Of the three agents I have currently, I'm only able to get one to talk completely with the server. This is what I get in the agent's ossec.log. 2008/03/07 10:02:22 ossec-agentd: Assigning counter for agent it-phoenix.secnet.ou.edu: '0:0'. 2008/03/07 10:02:22 ossec-agentd: Assigning sender counter: 0:386 2008/03/07 10:02:22 ossec-agentd: Started (pid: 5535). 2008/03/07 10:02:22 ossec-agentd: Connecting to server (129.15.3.106:1514). 2008/03/07 10:02:24 ossec-syscheckd: Started (pid: 5543). 2008/03/07 10:02:24 ossec-rootcheck: Started (pid: 5543). 2008/03/07 10:02:28 ossec-logcollector(1950): Analyzing file: '/var/log/messages'. 2008/03/07 10:02:28 ossec-logcollector(1950): Analyzing file: '/var/log/secure'. 2008/03/07 10:02:28 ossec-logcollector(1950): Analyzing file: '/var/log/maillog'. 2008/03/07 10:02:28 ossec-logcollector: Started (pid: 5539). 2008/03/07 10:02:37 ossec-agentd(4101): Waiting for server reply (not started). 2008/03/07 10:02:53 ossec-agentd(4101): Waiting for server reply (not started). 2008/03/07 10:03:24 ossec-agentd(4101): Waiting for server reply (not started). 2008/03/07 10:04:10 ossec-agentd(4101): Waiting for server reply (not started). 2008/03/07 10:04:38 ossec-logcollector: Process locked. Waiting for permission... 2008/03/07 10:05:11 ossec-agentd(4101): Waiting for server reply (not started). 2008/03/07 10:05:54 ossec-syscheckd: Process locked. Waiting for permission... 2008/03/07 10:06:27 ossec-agentd(4101): Waiting for server reply (not started). 2008/03/07 10:07:58 ossec-agentd(4101): Waiting for server reply (not started). Ossec.log exerpt from the server. 2008/03/07 10:18:49 ossec-monitord(1225): SIGNAL Received. Exit Cleaning... 2008/03/07 10:18:49 ossec-logcollector(1225): SIGNAL Received. Exit Cleaning... 2008/03/07 10:18:49 ossec-remoted(1225): SIGNAL Received. Exit Cleaning... 2008/03/07 10:18:49 ossec-syscheckd(1225): SIGNAL Received. Exit Cleaning... 2008/03/07 10:18:49 ossec-analysisd(1225): SIGNAL Received. Exit Cleaning... 2008/03/07 10:18:49 ossec-maild(1225): SIGNAL Received. Exit Cleaning... 2008/03/07 10:18:49 ossec-maild: Started (pid: 30549). 2008/03/07 10:18:49 ossec-execd(1350): Active response disabled. Exiting. 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'rules_config.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'pam_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'sshd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'telnetd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'syslog_rules.xml' 2008/03/07 10:18:49 ossec-remoted: Started (pid: 30565). 2008/03/07 10:18:49 ossec-remoted(1501): No IP or network allowed in the access list for syslog. No reason for running it. Exiting. 2008/03/07 10:18:49 ossec-remoted: Started (pid: 30567). 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'arpwatch_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'symantec-av_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'symantec-ws_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'pix_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'named_rules.xml' 2008/03/07 10:18:49 ossec-rootcheck: System audit file not configured. 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'smbd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'vsftpd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'pure-ftpd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'proftpd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'ms_ftpd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'hordeimp_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'vpopmail_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'courier_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'web_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'apache_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'mysql_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'postgresql_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'ids_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'squid_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'firewall_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'cisco-ios_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'netscreenfw_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'sonicwall_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'postfix_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'sendmail_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'imapd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'mailscanner_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'ms-exchange_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'racoon_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'vpn_concentrator_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'spamd_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'msauth_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'attack_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'zeus_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'ossec_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Reading rules file: 'local_rules.xml' 2008/03/07 10:18:49 ossec-analysisd: Total rules enabled: '692' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/mtab' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/mnttab' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/hosts.deny' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/mail/statistics' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/random-seed' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/adjtime' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/httpd/logs' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/utmpx' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/wtmpx' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/cups/certs' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/dumpdates' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: '/etc/svc/volatile' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/System32/LogFiles' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Debug' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/WindowsUpdate.log' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/iis6.log' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/wbem/Logs' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/wbem/Repository' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Prefetch' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/PCHEALTH/HELPCTR/DataColl' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/SoftwareDistribution' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/Temp' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/config' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/spool' 2008/03/07 10:18:49 ossec-analysisd: Ignoring file: 'C:\WINDOWS/system32/CatRoot' 2008/03/07 10:18:49 ossec-analysisd: Started (pid: 30557). 2008/03/07 10:18:50 ossec-remoted(1410): Reading authentication keys file. 2008/03/07 10:18:50 ossec-remoted: Assigning counter for agent it-brist-wrksta: '1:7983'. 2008/03/07 10:18:50 ossec-remoted: No previous counter available for 'it-phoenix.secnet.ou.edu'. 2008/03/07 10:18:50 ossec-remoted: Assigning counter for agent it-phoenix.secnet.ou.edu: '0:0'. 2008/03/07 10:18:50 ossec-remoted: No previous counter available for 'it-tucson.secnet.ou.edu'. 2008/03/07 10:18:50 ossec-remoted: Assigning counter for agent it-tucson.secnet.ou.edu: '0:0'. 2008/03/07 10:18:50 ossec-remoted: Assigning sender counter: 0:443 2008/03/07 10:18:50 ossec-monitord: Started (pid: 30577). 2008/03/07 10:18:52 ossec-syscheckd: Started (pid: 30573). 2008/03/07 10:18:52 ossec-rootcheck: Started (pid: 30573). 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/messages'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/auth.log'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/secure'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/syslog'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/xferlog'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/mail.info'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/maillog'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/mail.log'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/httpd/error_log'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/var/log/httpd/access_log'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/etc/httpd/logs/access_log'. 2008/03/07 10:18:55 ossec-logcollector(1950): Analyzing file: '/etc/httpd/logs/error_log'. 2008/03/07 10:18:55 ossec-logcollector: Started (pid: 30561).
