Make sure this agent's IP address is unique (or part of a CIDR range). Make sure you restarted the manager's OSSEC processes after adding the agent. Re-export/import the the agent's key. You can also try deleting the agent on the manager, and re-adding it.
On Tue, Mar 1, 2011 at 2:40 PM, Michael Barrett <[email protected]> wrote: > > I have an agent installed on 2003 64bit > > Server running on RHEL5 > > The agent can't connect > > > 2011/03/01 13:39:29 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '144.122.190.48'. > > 2011/03/01 13:39:31 ossec-agent: INFO: Trying to connect to server > (144.122.190.48:1514). > > > The server shows this message in /var/ossec/log/ossec.log > > 2011/03/01 13:34:44 ossec-remoted(1403): ERROR: Incorrectly formated message > from '144.122.218.24'. > 2011/03/01 13:34:48 ossec-remoted(1403): ERROR: Incorrectly formated message > from '144.122.218.24'. > 2011/03/01 13:34:53 ossec-remoted(1403): ERROR: Incorrectly formated message > from '144.122.218.24'. > 2011/03/01 13:34:59 ossec-remoted(1403): ERROR: Incorrectly formated message > from '144.122.218.24'. > > > > Please advise > > Thank you > ____________________________________________ > Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty > Insurance Corporation > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > 1.888.601.4440 | * [email protected] > > This message is intended for use only by the person(s) addressed above and > may contain privileged and confidential information. Disclosure or use of > this message by any other person is strictly prohibited. If this message is > received in error, please notify the sender immediately and delete this > message. >
