Port 514 is open, the problem in another. Not all messages are sent, compared with sniffer logs. Is it possible to configure ossec in the log is marked to send messages to syslog. Sorry so long to reply, this is not the primary problem, do as far as possible. And sometime windows agent show message error: 2010/04/27 10:45:11 ossec-agent: WARN: Server unavailable. Setting lock. firewall on windows(10.100.10.xx) and rhel(10.100.24.xx) are disabled. Thanks for your answers.
-- Subscription settings: http://groups.google.com/group/ossec-list/subscribe?hl=en
