What distro/revision? Any corresponding logs on the manager? What version of OSSEC? Are any OSSEC processes on the manager running at 100% cpu? Are there any firewalls that might be getting in the way?
On Fri, Jul 8, 2011 at 9:16 AM, gopal krishnan <[email protected]> wrote: > Hi, > > I have OSSEC server with 5 Linux ossec-agents running, when i retstart the > ossec-agent its working fine for sometime after that its going to inactive > mode, samething goes to for new agents also. > > OSSEC-agent logs: > > 2011/07/08 11:12:10 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '192.168.5.1'. > 2011/07/08 11:39:30 ossec-agentd: INFO: Trying to connect to server > (192.168.5.1:1514). > 2011/07/08 11:39:40 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 11:39:52 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 11:39:53 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: 192.168.5.1'. > 2011/07/08 12:07:31 ossec-agentd: INFO: Trying to connect to server > (192.168.5.1:1514). > 2011/07/08 12:07:41 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:07:53 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:07:54 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '192.168.5.1'. > 2011/07/08 12:35:50 ossec-agentd: INFO: Trying to connect to server > (192.168.5.1:1514). > 2011/07/08 12:36:00 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:36:12 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2011/07/08 12:36:13 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '192.168.5.1'. > Port is Establised b/w server and agent > udp 0 0 192.168.5.1:50450 192.168.5.42:1514 > ESTABLISHED off (0.00/0/0) > > > > Thanks, > -Gopal.C
