Is there a firewall in between the agent and server? If there is, it's possible that the firewall could blocking traffic from server to agent, but allowing traffic from agent to server.
On Fri, Jul 8, 2011 at 9:16 AM, gopal krishnan <[email protected]>wrote: > Hi, > > I have OSSEC server with 5 Linux ossec-agents running, when i retstart the > ossec-agent its working fine for sometime after that its going to inactive > mode, samething goes to for new agents also. > > OSSEC-agent logs: > > 2011/07/08 11:12:10 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '192.168.5.1'. > 2011/07/08 11:39:30 ossec-agentd: INFO: Trying to connect to server ( > 192.168.5.1:1514). > 2011/07/08 11:39:40 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 11:39:52 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 11:39:53 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: 192.168.5.1'. > 2011/07/08 12:07:31 ossec-agentd: INFO: Trying to connect to server ( > 192.168.5.1:1514). > 2011/07/08 12:07:41 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:07:53 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:07:54 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '192.168.5.1'. > 2011/07/08 12:35:50 ossec-agentd: INFO: Trying to connect to server ( > 192.168.5.1:1514). > 2011/07/08 12:36:00 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:36:12 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:36:13 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '192.168.5.1'. > Port is Establised b/w server and agent > udp 0 0 192.168.5.1:50450 192.168.5.42:1514 > ESTABLISHED off (0.00/0/0) > > > > Thanks, > -Gopal.C >
