Well I figured out the answer myself. A closer reading of the docs shows that I can setup the remote connect with a specific IP and port and that worked just fine.
--- On Thu, 7/1/10, Junk Mail <[email protected]> wrote: From: Junk Mail <[email protected]> Subject: [ossec-list] Does OSSEC server support multiple nics? To: [email protected] Date: Thursday, July 1, 2010, 9:46 AM If I have OSSEC installed on a machine with multiple nics can I configure 1 agent to send to 1 IP on the OSSEC server and a 2nd agent configured to send to the 2nd OSSEC server nic IP? From my preliminary testing it appears this does not work. To test I installed OSSEC server with only 1 nic working and 2 windows agents. I verify logs were getting sent from the agents to the server. I then added a 2nd nic on the server and restarted it. Changed the configuration on one of the agents to use the new IP address and restarted the agent. I am now getting this error in the ossec.log 2010/07/01 09:36:51 ossec-agent(4101): WARN: Waiting for server reply (not started). Tried: 'xxx.xxx.xxx.xxx'. Thanks, Russell
