The problem seems to have been a permissions issue. I noticed that although the UID and GID for ossec were the same on both servers, the UIDs for ossecm and ossecr were different. I re-ran the installation on the standby server with the correct UIDs, re-mirrored the data and (for the one agent I have tried so far) it worked.
One issue (which is perfectly understandable); the master monitors itself (using 127.0.0.1) so any differences in monitored folders between the primary and standby masters are producing alerts as changed files. I can live with that.
