The problem seems to have been a permissions issue.
I noticed that although the UID and GID for ossec were the same on both 
servers, the UIDs for ossecm and ossecr were different.
I re-ran the installation on the standby server with the correct UIDs, 
re-mirrored the data and (for the one agent I have tried so far) it worked.

One issue (which is perfectly understandable); the master monitors itself 
(using 127.0.0.1) so any differences in monitored folders between the 
primary and standby masters are producing alerts as changed files. I can 
live with that.

Reply via email to