Hi Martin, If you remove the rids files from both agents and manager and is still getting this error, you probably have some keys being reused.
Are all your agents not working or only a few of them? Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Tue, Jul 28, 2009 at 5:47 PM, Martin Tartarelli<[email protected]> wrote: > > ddp, > > 2009/7/28 ddp <[email protected]>: >> >> What operating systems/architectures? Did you restart the ossec server >> processes after adding the agents? >> > > Linux and Window OS > Yes, I restart the server processes > >> On Fri, Jul 24, 2009 at 10:41 AM, Martin >> Tartarelli<[email protected]> wrote: >>> >>> List, >>> >>> I have a problem with OSSEC. >>> Ossec server is not receiving any warning of the 110 agents installed. >>> In the log just shows a lot of messages: >>> >>> 2009/07/24 11:57:14 ossec-remoted(1213): WARN: Message from 172.x.x.x >>> not allowed. >>> 2009/07/24 11:50:32 ossec-remote (1403): BUG: Incorrectly formate >>> message from'172. Xxx. >>> 2009/07/24 11:51:53 ossec-remote (1407): ERROR: Duplicated counter for >>> 'SRV1. >>> >>> I tested removing the counters in /var/ossec/queue/rids/ on both sides >>> but still the same. >>> >>> suggestions will be appreciated >>> Thank you >>> >>> -- >>> Martin Tartarelli >>> Linux User #476492 >>> -- >>> >> > > > > -- > Martin Tartarelli > Linux User #476492 > http://owasp.org/index.php/Argentina > -- >
