I had double-checked the file permissions, the agent's agent.conf was owned by root -- which didn't match the process owner. Fixing that didn't resolve the problem, and there was never any errors logs on the agent. Even running the agent in full debug mode proved unhelpful. (the problem was be further upstream)
I then noticed that the server's /var/ossec/etc/shared/agent.conf was also owned by root (perms 540) and the server logs indicated a problem: 2010/11/22 06:31:25 ossec-remoted: Error accessing file '/etc/shared/ agent.conf' [r...@host etc]# ps -ef | grep remoted ossecr 11141 1 0 Nov19 ? 00:00:11 /var/ossec/bin/ossec- remoted ah ha...the user "ossecr" can't read the agent.conf. The file was owned by root, without world read access. I was so focused on the agent's settings, I forgot to carefully examine the permissions and ownership of the server. :( Solution: make sure that the server's agent.conf file is properly owned by the process running ossec-remoted.
