Hello,
We have had OSSEC v2.0 running successfully for quite a while and just
recently migrated to a new cluster. We copied over the /var/ossec and
the init file then ran the upgrade option for v2.5. We then reinstalled
the agents on the monitored servers since the main server IP is now
different.The problem we are facing is that after the installation, key
authorization and starting both the server and agent, the agent cannot
connect to the server. This is running on Centos 5 64bit, both
instances. The errors on the agent logs are as follows:
2010/10/01 14:41:17 ossec-agentd: INFO: Trying to connect to server
(x.x.x.x:1514).
2010/10/01 14:41:27 ossec-agentd(1218): ERROR: Unable to send message to
server.
2010/10/01 14:41:39 ossec-agentd(1218): ERROR: Unable to send message to
server.
2010/10/01 14:41:40 ossec-agentd(4101): WARN: Waiting for server reply
(not started). Tried: 'x.x.x.x'.
So, it says 'not started' which I assume it refers to ossec server. I
have verified that ossec is running on the main server. I have also
added the Ips of the agents to the hosts.allow file as well as the
firewall. I then turned off all firewalls on both server and agent and
still no luck. I'm pretty stumped at this.
Thank you for your help
- [ossec-list] agents cannot connect to server Tyoma Khmelnitsky
-