Looks like you have a firewall or Nat between the agent and the server. If you watch the ossec.logs on the server do you see a different ip trying to connect? On the server you would also do a tcpdump to ensure that the expected traffic is getting to the server.
example: tcpdump -ni eth0 port 1514 OSSEC Server mail configuration. Can you paste your server ossec.conf file here? On Sun, Oct 17, 2010 at 05:32, Lendz <[email protected]> wrote: > Hi all, I got these problem. > I installed window agent on window 7 system, when I add OSSEC's IP and > key then start agent software, I got the announcement "Unable to start > OSSEC (check config)". I checked agent's log: > > ossec-agent(4101): WARN: Waiting for server reply (not started). > Tried: '192.168.73.131'. > ossec-agent: INFO: Trying to connect to server (192.168.73.131:1514). > > (I turned off windows firewall and OSSEC's firewall) > when I check OSSEC's server with command: /var/ossec/bin/agent_control > -l > > ID: 000, Name: localhost.localdomain (server), IP: 127.0.0.1, Active/ > Local > ID: 001, Name: Windows, IP: 192.168.3.2, Never connected > > I added agent's IP in > <global> > <white_list>192.168.3.2</white_list> > </global> > > <remote> > <connection>syslog</connection> > <allowed-ips>192.168.3.2</allowed-ips> > </remote> > > In OSSEC's log I also got "ossec-maild(1223): ERROR: Error Sending > email to 74.125.77.27 (smtp server)" > I'm using Gmail for alert > > Please tell me what problem I got and how to fix it > Many thanks > -- Registered Linux User # 379282
