I think this is related to an upgrade on the server. The person doing the upgrade did not follow the correct procedure and I believe all the keys are corrupted. I have regenerated some of the keys for the agents failing and that has seemed to fix the problem.
If I remove the key and generate a new one the agent starts up fine and reports in. ____________________________________________ Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty Insurance Corporation 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 1.888.601.4440 | * [email protected] “Accomplishing the impossible means only that your boss will add it to your regular duties” Doug Larson This message is intended for use only by the person(s) addressed above and may contain privileged and confidential information. Disclosure or use of this message by any other person is strictly prohibited. If this message is received in error, please notify the sender immediately and delete this message. |------------> | From: | |------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| |"Peter M. Abraham" <[email protected]> | >--------------------------------------------------------------------------------------------------------------------------------------------------| |------------> | To: | |------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| |ossec-list <[email protected]> | >--------------------------------------------------------------------------------------------------------------------------------------------------| |------------> | Date: | |------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| |12/09/2009 08:57 AM | >--------------------------------------------------------------------------------------------------------------------------------------------------| |------------> | Subject: | |------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| |[ossec-list] Re: Fw: agents disconnected | >--------------------------------------------------------------------------------------------------------------------------------------------------| |------------> | Sent by: | |------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| |[email protected] | >--------------------------------------------------------------------------------------------------------------------------------------------------| Greetings Michael: I believe "2009/12/02 11:29:04 ossec-agent: INFO: Trying to connect to server (144.122.190.48:1514). " is the starting point for trouble shooting. Can the agents connect to 144.122.190.48 on port 1514? Is this a problem for all agents or just some agents? Do you have ACL or a firewall on 144.122.190.48? If yes, is 1514 open to the world or only to agents? If the latter, are the agents having trouble connecting in the ACL/firewall for being allowed to access? When did this problem start? Where any upgrades done on the agent or server within 72 hours of the problem starting? Thank you.
