Run a sniffer on the manager to make sure the packets are getting to it. Check the ossec.log on the manager to see if there are any errors. Turning on debugging (/var/ossec/bin/ossec-control enable debugging), and restarting the ossec processes (both manager and agents) might provide some more useful logs.
On Fri, Oct 1, 2010 at 2:44 PM, Tyoma Khmelnitsky <[email protected]> wrote: > Hello, > > We have had OSSEC v2.0 running successfully for quite a while and just > recently migrated to a new cluster. We copied over the /var/ossec and the > init file then ran the upgrade option for v2.5. We then reinstalled the > agents on the monitored servers since the main server IP is now > different.The problem we are facing is that after the installation, key > authorization and starting both the server and agent, the agent cannot > connect to the server. This is running on Centos 5 64bit, both instances. > The errors on the agent logs are as follows: > > 2010/10/01 14:41:17 ossec-agentd: INFO: Trying to connect to server > (x.x.x.x:1514). > 2010/10/01 14:41:27 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2010/10/01 14:41:39 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2010/10/01 14:41:40 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: 'x.x.x.x'. > > So, it says 'not started' which I assume it refers to ossec server. I have > verified that ossec is running on the main server. I have also added the Ips > of the agents to the hosts.allow file as well as the firewall. I then turned > off all firewalls on both server and agent and still no luck. I'm pretty > stumped at this. > > Thank you for your help > >
