Greetings: While I'm still having problems on our own XenServer installation (just working on today), I did solve one of the problems by reviewing http://www.ossec.net/main/manual/configuration-options/
In our case the ossec server is on a XenGuest (not dom0), and I ended up using the <local_ip>abc.def.hij.klm</local_ip> to /var/ossec/etc/ ossec.conf on the server end. Even though UDP 1514 was listened on for all IP's, I had to specify the public network IP for it to sort of work (I'm having other problems now). Thank you.
