I have an OSSEC management server watching two Windows servers - all has been working well there. For some reason I can't get a third server working with active response, though. I keep getting the message:
2009/12/07 21:11:19 ossec-agent: ERROR: Unable to create active response process. when testing a brute force ftp attack. I get the same message when testing via the agent_control program to try to trigger the route-null.cmd to run using the command: /var/ossec/bin/agent_control -b 216.10.8.9 -f win_nullroute7200 -u 011 The same command against a different agent runs okay. No active response log shows up on the system where the AR isn't running. I do get the following line in the ossec.log on that agent system: 2009/12/07 20:42:58 ossec-execd: INFO: Started (pid: 2416) so the AR process seems to be starting okay. I have changed the route-null.cmd to use a specifici IP address for the null route, as the %IPADDR% value on the line seemed to keep the null route from working as expected. But the same change has been made on all three agent sytems, and the other two have always worked fine with that change. Where to look to try to troubleshoot further why this one agent setup won't trigger the AR? Greg
