Hi Pierre, Is there anything on the server's log about it? Also, do you get any alert that the Windows box was disconnected? We have version 1.6.1 with a few fixes available that might solve some of this issues...
Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Tue, Oct 7, 2008 at 11:39 AM, Pierre Boisvert <[EMAIL PROTECTED]> wrote: > Hi, > > No firewall on the server and on the agent. > > Server (ossec-remoted) is listening on 1514 > > only one NIC per server. > > > Communication work for a while and than stop for 2 to 3 hours, than start > again for one hour and than stop again for 3 hours... > > Pierre > > ---------- Forwarded message ---------- > From: Herb Steck <[EMAIL PROTECTED]> > Date: Fri, Oct 3, 2008 at 2:36 PM > Subject: [ossec-list] Re: Agent Server communication problem > To: [email protected] > > > > I too have the same problem. Upgraded from 1.4 to 1.6. No issues before. > > 1) there is no firewall between the agent & server > 2) Only a single network card within the server and the agent > > In the WebUI the agent shows that it's last update was within minutes or > within a time that indicates it is communicating with the server. > > -----Original Message----- > From: [email protected] [mailto:[EMAIL PROTECTED] On > Behalf Of Peter M. Abraham > Sent: Friday, October 03, 2008 9:15 AM > To: ossec-list > Subject: [ossec-list] Re: Agent Server communication problem > > > Greetings: > > I've had this happen, and it typically was one of two things: > > 1. The agent AND the server firewall did not allow UDP 1514 traffic > in/out. > > 2. I did not use the primary network card IP address of the agent > when creating the agent key. > > In rare conditions (only once out of 40 agents), I needed to use CIDR > (i.e. /24, etc.) for the agent IP rather than the complete IP. > > Please consider checking the above areas in your ossec setup / > environment. > > Thank you. > > > >
