Hi Billy, On Mon, Jan 10, 2011 at 12:55 PM, Billy McCarthy <[email protected]> wrote: > I've got Ossec up and running, using the RPMs provided by Atomicorp, but > cannot get agents to talk to the main server. When I run `manage_agents` on > my main server it gives me the short menu, like you see on clients. I was > able to create the client key on that server anyway and import it onto the > client. If I run 'manage_agents -e 001' on the main server, though it says > "2011/01/10 17:51:03 manage_agents: You can't export keys on an agent" >
It appears you've got the client/agent RPMs installed on the manager. There appears to be an ossec-hids-server RPM available. > I've tried re-running the configure script, but can't seem to convince the > main server that it's the manager. Have I missed something? I've verified > that traffic is passing between the 2 machines via tcpdump. The client's > ossec.log has lots of: > 2011/01/09 09:59:42 ossec-agentd: INFO: Trying to connect to server > (10.24.161.142:1514). > 2011/01/09 10:00:03 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '10.24.161.142'. > Which I figure is related to the main server not considering itself the > manager. > > thanks for the help. > > -- > Billy McCarthy > Site Operations Engineer > http://www.tripit.com > >
