Hi Michael, Do you get any errors on the manager's ossec.log file? Check there as well..
thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Thu, Apr 22, 2010 at 11:05 AM, Michael Barrett <[email protected]> wrote: > I am having an issue with one of my systems. This is OSSEC Windows version > 2.2 on Windows Sever 2003 64bit > > I have tried the install via the setup program as well as copying the files > from another server and updating the client.keys file and manually creating > the service. > > I also tried to remove the agent from the server and recreate the key. > > No matter what I do the agent cannot connect to the server. > > Is there something I am missing? > > 2010/04/22 08:54:02 ossec-agent(1905): INFO: No file configured to monitor. > > 2010/04/22 08:54:02 ossec-execd(1350): INFO: Active response disabled. > Exiting. > > 2010/04/22 08:54:02 ossec-agent(1410): INFO: Reading authentication keys > file. > > 2010/04/22 08:54:02 ossec-agent: INFO: Trying to connect to server > (144.122.190.48:1514). > > 2010/04/22 08:54:02 ossec-agent: Starting syscheckd thread. > > 2010/04/22 08:54:02 ossec-rootcheck: INFO: Started (pid: 308). > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\Software\Policies'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\Software\Classes'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring registry entry: > 'HKEY_LOCAL_MACHINE\Security'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Monitoring directory: > 'C:\WINDOWS/system32'. > > 2010/04/22 08:54:02 ossec-agent: INFO: Started (pid: 308). > > 2010/04/22 08:54:13 ossec-agent: WARN: Process locked. Waiting for > permission... > ____________________________________________ > Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty > Insurance Corporation > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > 1.888.601.4440 | * [email protected] > > > “Accomplishing the impossible means only that your boss will add it to your > regular duties” Doug Larson > > This message is intended for use only by the person(s) addressed above and > may contain privileged and confidential information. Disclosure or use of > this message by any other person is strictly prohibited. If this message is > received in error, please notify the sender immediately and delete this > message. > > -- > Subscription settings: > http://groups.google.com/group/ossec-list/subscribe?hl=en >
