Greetings: I've had this happen, and it typically was one of two things:
1. The agent AND the server firewall did not allow UDP 1514 traffic in/out. 2. I did not use the primary network card IP address of the agent when creating the agent key. In rare conditions (only once out of 40 agents), I needed to use CIDR (i.e. /24, etc.) for the agent IP rather than the complete IP. Please consider checking the above areas in your ossec setup / environment. Thank you.
