Hello Here the response : ps -ef | grep /var/ossec/bin/ossec-remoted root 4069 2450 0 23:28 pts/0 00:00:00 grep /var/ossec/bin/ossec-remoted
-> apparently it doesn't want to start :( And i don't know why (no error) ... debiantest:/var/ossec# /var/ossec/bin/ossec-remoted debiantest:/var/ossec# ps -ef | grep /var/ossec/bin/ossec-remoted root 4077 2450 0 23:29 pts/0 00:00:00 grep /var/ossec/bin/ossec-remoted and in the log file today (the server is not at time): 2010/05/17 00:01:47 ossec-monitord: No previous md5 checksum found: '/logs/archives/2010/May/ossec-archive-15.log.sum'. Starting over. 2010/05/17 00:01:47 ossec-monitord: No previous sha1 checksum found: '/logs/archives/2010/May/ossec-archive-15.log.sum'. Starting over. 2010/05/17 00:01:47 ossec-monitord: No previous md5 checksum found: '/logs/alerts/2010/May/ossec-alerts-15.log.sum'. Starting over. 2010/05/17 00:01:47 ossec-monitord: No previous sha1 checksum found: '/logs/alerts/2010/May/ossec-alerts-15.log.sum'. Starting over. 2010/05/17 00:01:47 ossec-monitord: No previous md5 checksum found: '/logs/firewall/2010/May/ossec-firewall-15.log.sum'. Starting over. 2010/05/17 00:01:47 ossec-monitord: No previous sha1 checksum found: '/logs/firewall/2010/May/ossec-firewall-15.log.sum'. Starting over. 2010/05/17 19:59:57 ossec-rootcheck: INFO: Starting rootcheck scan. 2010/05/17 20:02:36 ossec-rootcheck: INFO: Ending rootcheck scan. 2010/05/17 21:52:36 ossec-syscheckd: INFO: Starting syscheck scan. 2010/05/17 21:58:38 ossec-syscheckd: INFO: Ending syscheck scan. 2010/05/17 23:25:19 ossec-remoted: INFO: Started (pid: 4051). 2010/05/17 23:27:26 agent_control(1210): ERROR: Queue '/queue/alerts/ar' not accessible: 'Queue not found'. 2010/05/17 23:27:41 agent_control(1301): ERROR: Unable to connect to active response queue. 2010/05/17 23:29:15 ossec-remoted: INFO: Started (pid: 4074). 2010/05/17 23:30:58 ossec-remoted: INFO: Started (pid: 4081). /var/ossec/bin/agent_control -lc OSSEC HIDS agent_control. List of available agents: ID: 000, Name: debiantest (server), IP: 127.0.0.1, Active/Local /var/ossec/bin/agent_control -r -a 2010/05/17 23:27:26 agent_control(1210): ERROR: Queue '/queue/alerts/ar' not accessible: 'Queue not found'. 2010/05/17 23:27:41 agent_control(1301): ERROR: Unable to connect to active response queue. ** Unable to connect to remoted. Thank you -----Message d'origine----- De : [email protected] [mailto:[email protected]] De la part de dan (ddp) Envoyé : mercredi 19 mai 2010 17:49 À : [email protected] Objet : Re: [ossec-list] No agent available On Wed, May 19, 2010 at 5:08 AM, BOUTROUILLE PASCAL <[email protected]> wrote: > > > > Hello > > I go on to search, and i have installed a new server today, but always the > same message : no agent available > debiantest:~# /var/ossec/bin/agent_control -l > > OSSEC HIDS agent_control. List of available agents: > ID: 000, Name: debiantest (server), IP: 127.0.0.1, Active/Local > ID: 001, Name: windows1, IP: 10.113.12.23, Never connected > ID: 002, Name: linux1, IP: 10.113.12.8, Never connected > List of agentless devices: > > debiantest:~# /var/ossec/bin/list_agents -a > ** No agent available. > > Thank you for your help. > > > > Make sure ossec-remoted is running. It may help to run it in debug mode if there are any issues. Are there any errors in /var/ossec/logs/ossec.log on either the agents or the server? Are there any firewalls that could be in the way? Can you post your ossec.conf from the server? Is the correct server IP in the ossec.conf files on the agents?
