Dan, thanks, I will give that a shot and report back.
On 10/1/2010 3:04 PM, dan (ddp) wrote:
Run a sniffer on the manager to make sure the packets are getting to it.
Check the ossec.log on the manager to see if there are any errors.
Turning on debugging (/var/ossec/bin/ossec-control enable debugging),
and restarting the ossec processes (both manager and agents) might
provide some more useful logs.
On Fri, Oct 1, 2010 at 2:44 PM, Tyoma Khmelnitsky
<[email protected]> wrote:
Hello,
We have had OSSEC v2.0 running successfully for quite a while and just
recently migrated to a new cluster. We copied over the /var/ossec and the
init file then ran the upgrade option for v2.5. We then reinstalled the
agents on the monitored servers since the main server IP is now
different.The problem we are facing is that after the installation, key
authorization and starting both the server and agent, the agent cannot
connect to the server. This is running on Centos 5 64bit, both instances.
The errors on the agent logs are as follows:
2010/10/01 14:41:17 ossec-agentd: INFO: Trying to connect to server
(x.x.x.x:1514).
2010/10/01 14:41:27 ossec-agentd(1218): ERROR: Unable to send message to
server.
2010/10/01 14:41:39 ossec-agentd(1218): ERROR: Unable to send message to
server.
2010/10/01 14:41:40 ossec-agentd(4101): WARN: Waiting for server reply (not
started). Tried: 'x.x.x.x'.
So, it says 'not started' which I assume it refers to ossec server. I have
verified that ossec is running on the main server. I have also added the Ips
of the agents to the hosts.allow file as well as the firewall. I then turned
off all firewalls on both server and agent and still no luck. I'm pretty
stumped at this.
Thank you for your help
