Hi, No firewall on the server and on the agent.
Server (ossec-remoted) is listening on 1514 only one NIC per server. Communication work for a while and than stop for 2 to 3 hours, than start again for one hour and than stop again for 3 hours... Pierre ---------- Forwarded message ---------- From: Herb Steck <[EMAIL PROTECTED]> Date: Fri, Oct 3, 2008 at 2:36 PM Subject: [ossec-list] Re: Agent Server communication problem To: [email protected] I too have the same problem. Upgraded from 1.4 to 1.6. No issues before. 1) there is no firewall between the agent & server 2) Only a single network card within the server and the agent In the WebUI the agent shows that it's last update was within minutes or within a time that indicates it is communicating with the server. -----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of Peter M. Abraham Sent: Friday, October 03, 2008 9:15 AM To: ossec-list Subject: [ossec-list] Re: Agent Server communication problem Greetings: I've had this happen, and it typically was one of two things: 1. The agent AND the server firewall did not allow UDP 1514 traffic in/out. 2. I did not use the primary network card IP address of the agent when creating the agent key. In rare conditions (only once out of 40 agents), I needed to use CIDR (i.e. /24, etc.) for the agent IP rather than the complete IP. Please consider checking the above areas in your ossec setup / environment. Thank you.
