On Fri, Oct 1, 2010 at 5:17 PM, Tyoma Khmelnitsky <[email protected]> wrote: > Yeah, IP is correct. But just to verify, is there a way to check what IP > ossec manager is running/listening on? > > Active response is enabled on the manager. I hit 'y' for everything. > > Thanks for your help > >
"netstat -an | grep 1514" should tell you which IP the process is listening on. tcpdump on an agent could help verify that it is trying the correct one.
