On Tue, Oct 5, 2010 at 1:05 PM, Michael Barrett <[email protected]> wrote: > > Yes, yes and yes > ____________________________________________
Try running remoted in debug mode (ossec-remoted -d) to see if the error gets any more verbose. The agent doesn't happen to have multiple IPs or something does it? The manual page on this error seems to think this is a common problem for systems with multiple IPs: http://www.ossec.net/doc/faq/unexpected.html#what-does-1403-incorrectly-formated-message-means
