The manager shouldn't be an older version than the clients. Seeing the complete error would be nice, as would seeing some of the configurations.
On Tue, Feb 8, 2011 at 7:07 AM, maker007 <[email protected]> wrote: > hi all, > > I have a lot of these messages in manager log: > > ossec-remoted(1310): WARN: Invalid active response (execd) message '1: > (<client name>'. > > the messages repeat for all clients almost every minute. > > After some time clients stop sending events to the manager (no new > events in alerts.log). If ossec manager is restarted it works fine cca > 10 hours. > > I use ossec 2.4.1 on manager and 2.4.1 or 2.5.1 on clients. I also > have a centralized configuration in ./etc/shared/agent.conf. > > Only one active response is configured and its fired correctly. If I > comment out this active response, the messages still appeared. > > Can anyone help me in fixing this. > Regards > Maker007 > > > >
