I have ran into this quite a bit. Have you tried deleting the agent out of the server and readding it with a different agent id? For some reason that fixed my communication problems.
-Andy On Mar 18, 2009, at 6:40 PM, "Kartik Chadha" <[email protected]> wrote: > > I have the same problem.. > > Agents not communicating with the server. > > Checked everything (firewall, ports) but still no communication. > > Also, rootkits are not being detected by agents. > > Need help...thanks > > Charlotteix9 > > -----Original Message----- > From: [email protected] [mailto:ossec- > [email protected]] On > Behalf Of Jose Luis Vázquez González > Sent: March-18-09 4:53 AM > To: ossec-list > Subject: [ossec-list] Ossec agents not communcating with the server > > > The ossec agents are NOT communicating with the server... > > 1) IT IS NOT a firewall issue, FIRST I added the 1514/udp rule to the > server firewall, THEN I even tried to take down iptables completely in > both agents AND the server. > > 2) I reinstalled the keys (as explained here > http://www.ossec.net/wiki/index.php/Errors:AgentCommunication) on one > agent and it didn't work either. > > Synthoms: > > One agent complains that: > "Process locked..." > "Trying to connect to server..." > "Error: Unable to connect to server" > > The other (the one with renewed keys) complains that: > "Process locked..." (and stays like taht for ever) > > The server DOES NOT produce any output WHEN thet clients complain. But > I have checked some previous complains in wich ossec-remoted sais: > "Error: No IP or network allowed in the access file list for > syslog..." > > Has this any solution or should I just give up and "throw ossec to the > bin"? > > (I am a developer most of my time more than a sysadmin, so I don't > have much time to spare on things like this) > > Thanks in adavance for any responses! > CONFIDENTIALITY NOTICE: This correspondence, and all attachments transmitted with it, may contain legally privileged and confidential information intended solely for the use of the intended recipient. If the reader of this message is not the intended recipient or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying or other use of this communication is strictly prohibited. If you have received this message in error, please notify the sender immediately by telephone at 580.213.1730, or by electronic mail [email protected], and delete this message and all copies and backups thereof. Failure to comply with this confidentiality notice may result in criminal or civil penalties and/or prosecution.
