hi all, I have a lot of these messages in manager log:
ossec-remoted(1310): WARN: Invalid active response (execd) message '1: (<client name>'. the messages repeat for all clients almost every minute. After some time clients stop sending events to the manager (no new events in alerts.log). If ossec manager is restarted it works fine cca 10 hours. I use ossec 2.4.1 on manager and 2.4.1 or 2.5.1 on clients. I also have a centralized configuration in ./etc/shared/agent.conf. Only one active response is configured and its fired correctly. If I comment out this active response, the messages still appeared. Can anyone help me in fixing this. Regards Maker007
