On Fri, Oct 1, 2010 at 5:57 PM, Tyoma Khmelnitsky <[email protected]> wrote: > That's strange, netstat returns nothing on manager on port 1514. I > installed this from scratch as well to see if it'll work. Any ideas what I > may be over looking? > > Thank you again for your help >
If nothing is listening on 1514, then the at least one of the daemons is crashing (ossec-remoted I think, but I don't have an installation handy to check). There should be something in ossec.log on the manager for any failures. Sometimes segfault messages also appear in /var/log/messages. If you want you can stop the ossec processes on the manager, move ossec.log out of the way, and start it up again. Then send the new ossec.log (removing any IPs). Did you install this to /var/ossec? Is /var/ossec a symlink? Did the permissions copy over properly? Are the ossec user accounts and groups on the new system? Are they using the same uid/gid as on the previous manager system?
