Is this happening to all agents or just some? Just 1 out of 10 Were the agents that cannot connect now ever able to connect (maybe before the upgrade)?
Yes, it was working great Which versions were they previously running? 2.4.1 What platforms are the not working agents on (OS/revision)? Windows Server 2003 R2 Are there any useful log messages on the OSSEC manager? 2011/01/24 09:02:29 ossec-remoted(1407): ERROR: Duplicated counter for 'Server5'. 2011/01/24 09:02:34 ossec-remoted: WARN: Duplicate error: global: 0, local: 50, saved global: 38, saved local:8532 2011/01/24 09:02:34 ossec-remoted(1407): ERROR: Duplicated counter for 'Server5'. 2011/01/24 09:27:32 ossec-testrule: INFO: Reading local decoder file. 2011/01/24 09:27:32 ossec-execd(1350): INFO: Active response disabled. Exiting. 2011/01/24 09:46:04 ossec-remoted(1403): ERROR: Incorrectly formated message from '192.168.1.5'. 2011/01/24 09:47:14 ossec-remoted(2202): ERROR: Error uncompressing string. Thanks for your help, Mike On Mon, Jan 24, 2011 at 12:35 PM, dan (ddp) <[email protected]> wrote: > Hi Mike, > > On Mon, Jan 24, 2011 at 1:42 PM, Mike Smith <[email protected]> wrote: > > Hello, > > > > I upgraded to 2.5.1 server and agents. Now I'm getting this warning. I > have > > no Firewalls between server and agents. I uninstalled agent, did not > work, > > i deleted agent from server, created new agent, still not working. > > > > Is this happening to all agents or just some? > Were the agents that cannot connect now ever able to connect (maybe > before the upgrade)? > Which versions were they previously running? > What platforms are the not working agents on (OS/revision)? > Are there any useful log messages on the OSSEC manager? > > > > error message: > > > > 2011/01/24 11:02:39 ossec-agent: WARN: Process locked. Waiting for > > permission... > > 2011/01/24 11:02:50 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:02:52 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:03:13 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:03:33 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:03:54 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:04:32 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:04:53 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:05:49 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:06:10 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:07:24 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:07:45 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:09:17 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:09:38 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:11:28 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:11:49 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:13:57 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:14:18 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:16:44 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:17:05 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:19:49 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:20:10 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:23:12 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:23:33 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:26:53 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:27:14 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:30:52 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:31:13 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > 2011/01/24 11:35:09 ossec-agent: INFO: Trying to connect to server > > (192.168.1.51:1514). > > 2011/01/24 11:35:30 ossec-agent(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.1.51'. > > > > Thanks, > > > > -Mike >
