On Mon, Jan 10, 2011 at 3:23 PM, dan (ddp) <[email protected]> wrote: > > <allowed-ips> is only necessary for syslog connection types. > > It's very odd that there's no logs in the manager's ossec.log that > relate to this agent. Is iptables turned off, or did you add a hole > for UDP 1514 into the ruleset? > > The only thing I can think off right now are deleting the agent and > re-adding it via manage_agents on the manager (make sure you re-export > the key and re-import it into the agent). > > Ok, I'm willing to admit it, I'm an idiot. I've looked at the iptables listing at least a dozen times today and kept seeing the very first entry as accepting traffic from anywhere to any port over 1024, not just dns traffic. ACCEPT udp -- any any anywhere anywhere udp spt:domain dpts:1024:65535
Thank you so much for your help, and patience. I'm going to blame this on the cold that kept me on the couch for half of last week. -- Billy McCarthy Site Operations Engineer http://www.tripit.com
