On Mon, Jan 10, 2011 at 11:45 AM, dan (ddp) <[email protected]> wrote:
> Hi Billy, > > On Mon, Jan 10, 2011 at 12:55 PM, Billy McCarthy <[email protected]> > wrote: > > I've got Ossec up and running, using the RPMs provided by Atomicorp, but > > cannot get agents to talk to the main server. When I run `manage_agents` > on > > my main server it gives me the short menu, like you see on clients. I > was > > able to create the client key on that server anyway and import it onto > the > > client. If I run 'manage_agents -e 001' on the main server, though it > says > > "2011/01/10 17:51:03 manage_agents: You can't export keys on an agent" > > > > It appears you've got the client/agent RPMs installed on the manager. > There appears to be an ossec-hids-server RPM available. > I did have the ossec-hids-server package installed, though I've since removed the packages on that machine and just installed via the tarball. Still not able to get the client to connect. I've tried setting up new keys, and have turned on all of the debugging I can find, with no luck. I can see traffic with tcpdump and have verified that iptables isn't blocking anything. > > > I've tried re-running the configure script, but can't seem to convince > the > > main server that it's the manager. Have I missed something? I've > verified > > that traffic is passing between the 2 machines via tcpdump. The client's > > ossec.log has lots of: > > 2011/01/09 09:59:42 ossec-agentd: INFO: Trying to connect to server > > (10.24.161.142:1514). > > 2011/01/09 10:00:03 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '10.24.161.142'. > > Which I figure is related to the main server not considering itself the > > manager. > > > > thanks for the help. > > > > -- > > Billy McCarthy > > Site Operations Engineer > > http://www.tripit.com > > > > > -- Billy McCarthy Site Operations Engineer http://www.tripit.com
