Is 123.456.789.012 configured to send Syslog messages (no OSSEC agent) to
this OSSEC server? Have you tried putting something like the following in
the ossec.conf file and then restarting OSSEC?
<remote>
<connection>syslog</connection>
<allowed-ips>123.456.789.012</allowed-ips>
</remote>
For further information, please see:
http://www.ossec.net/wiki/index.php/PIX_and_IOS_Syslog_Config_examples
Let us know whether or not that helps.
On 6/6/08 2:49 AM, "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> wrote:
>
>
> Hi,
>
> After a while i'm back and again i'm implementing the great ossec in a
> company logging structure.
> But now i get the following error message in the ossec.log on the
> server.
>
> ossec-remoted(1213): WARN: Message from 123.456.789.012 not allowed.
>
> where 123.456.789.012 is the ip address.
>
> I can't find the explanation or solution of dit error anywhere.
>
> Thanks in advance,
>
> Ruurd Bakker
>
