Here are the ossec processes running: ============= :~/ossec-hids-2.4$ ps aux | grep ossec ossecm 6258 0.0 0.0 18888 652 ? S 11:36 0:00 /var/ ossec/bin/ossec-maild ossec 6266 0.0 0.2 13908 2056 ? S 11:36 0:02 /var/ ossec/bin/ossec-analysisd root 6271 0.0 0.0 4208 556 ? S 11:36 0:00 /var/ ossec/bin/ossec-logcollector root 6279 0.1 0.1 4408 1076 ? S 11:36 0:10 /var/ ossec/bin/ossec-syscheckd ossec 6282 0.0 0.0 12740 632 ? S 11:36 0:00 /var/ ossec/bin/ossec-monitord ossecm 7510 0.0 0.0 18888 648 ? S 11:45 0:00 /var/ ossec/bin/ossec-maild ossec 7518 0.0 0.2 13908 2052 ? S 11:45 0:02 /var/ ossec/bin/ossec-analysisd root 7522 0.0 0.0 4208 556 ? S 11:45 0:00 /var/ ossec/bin/ossec-logcollector root 7534 0.1 0.1 4412 1052 ? S 11:45 0:10 /var/ ossec/bin/ossec-syscheckd ossec 7538 0.0 0.0 12740 616 ? S 11:45 0:00 /var/ ossec/bin/ossec-monitord ===============
I havent seen anything in the logs that would be useful. I will keep poking around. Thanks! Anapologetos On Jun 1, 12:15 pm, "dan (ddp)" <[email protected]> wrote: > What ossec processes are running on the server? > Have you tried running tcpdump on the server to see if the packets are > making it? > Anything in the logs of the server or agents that might be useful in > tracking down the issue? > > > > On Tue, Jun 1, 2010 at 11:50 AM, Anapologetos <[email protected]> wrote: > > I have installed ossec 2.4 on Ubuntu Lucid as a Server install. I am > > trying to connect Server 2008 agents to it, but I continue to get > > "waiting for server reply" errors on the agents. I have disabled all > > firewalls in between the servers. > > > When I run netstat on the ossec server, I dont even see any upd/tcp > > port 1514 listening: > > ============================ > > netstat -ltpan > > Active Internet connections (servers and established) > > Proto Recv-Q Send-Q Local Address Foreign Address > > State PID/Program name > > tcp 0 0 0.0.0.0:22 0.0.0.0:* > > LISTEN - > > tcp 0 0 127.0.0.1:631 0.0.0.0:* > > LISTEN - > > tcp 0 0 0.0.0.0:25 0.0.0.0:* > > LISTEN - > > tcp 0 52 192.168.65.190:22 192.168.65.18:2432 > > ESTABLISHED - > > tcp6 0 0 :::5900 :::* > > LISTEN 2640/vino-server > > tcp6 0 0 :::22 :::* > > LISTEN - > > tcp6 0 0 ::1:631 :::* > > LISTEN - > > > ******...@**********:~/ossec-hids-2.4$ netstat -lupan > > Active Internet connections (servers and established) > > Proto Recv-Q Send-Q Local Address Foreign Address > > State PID/Program name > > udp 0 0 0.0.0.0:5353 > > 0.0.0.0:* - > > udp 0 0 0.0.0.0:56197 0.0.0.0:* > > ============================= > > > What am I doing wrong?
