If you're using the secure option, it uses port 1514. If you're using syslog, I think it uses 514.
On Tue, Jun 1, 2010 at 9:59 AM, BOUTROUILLE PASCAL <[email protected]> wrote: > Hello > > > > I always have a problem with the ossec server > > I do a new installation from debian to kubuntu. > > It ‘s better, because the server see now itself in the agent available, so > i have 1 agent : the server. > > I have created 2 other agent : 1 windows and 1 debian : > > > > /var/ossec/bin# ./agent_control -lc > > OSSEC HIDS agent_control. List of available agents: > > ID: 000, Name: ubuntutest (server), IP: 127.0.0.1, Active/Local > > > > But : > > ./agent_control -l > > OSSEC HIDS agent_control. List of available agents: > > ID: 000, Name: ubuntutest (server), IP: 127.0.0.1, Active/Local > > ID: 001, Name: windows1, IP: 10.133.125.23, Never connected > > ID: 002, Name: uxrec13, IP: 10.133.3.8, Never connected > > > > è Why « never connected » ? > > I try to restart agent, enter again the key, but same problem > > How can i test the communication between agent and server ? what port use > the server ? > > > > In the agent log : > > 2010/06/01 15:47:36 ossec-agent: INFO: Trying to connect to server > (10.133.125.45:1514). > > 2010/06/01 15:47:57 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '10.133.125.45'. > > 2010/06/01 15:50:23 ossec-agent: INFO: Trying to connect to server > (10.133.125.45:1514). > > 2010/06/01 15:50:44 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '10.133.125.45'. > > 2010/06/01 15:53:28 ossec-agent: INFO: Trying to connect to server > (10.133.125.45:1514). > > 2010/06/01 15:53:49 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '10.133.125.45'. > > 2010/06/01 15:56:51 ossec-agent: INFO: Trying to connect to server > (10.133.125.45:1514). > > 2010/06/01 15:57:12 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '10.133.125.45'. > > > > With the server : > > ossec-monitord is running... > > ossec-logcollector is running... > > ossec-syscheckd is running... > > ossec-analysisd is running... > > ossec-maild is running... > > ossec-execd is running... > > > > Thank you
