Hi Dan, Thanks for posting,
1) What distro/revision? OSSEC HIDS v2.4.1 2) OSSEC server version: DIRECTORY="/var/ossec" VERSION="v2.5" DATE="Tue Jul 5 13:09:21 UTC 2011" TYPE="server" 3) Server Side i am seeing the following issue: 2011/07/12 10:30:05 ossec-remoted: socketerr (not available). 2011/07/12 10:30:05 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' not accessible: 'Connection refused'. 2011/07/12 10:30:08 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' not accessible: 'Connection refused'. 2011/07/12 10:30:08 ossec-remoted(1211): ERROR: Unable to access queue: '/queue/ossec/queue'. Giving up.. 4) Are any OSSEC processes on the manager running at 100% cpu? NO 5) Are there any firewalls that might be getting in the way? No Firewall in place, But when i do the # telnet <host> 1514 its not connecting both from server and client, But when i restart the client the log saying connected to the server with port 1514. Thank you, -Gopal.C On Fri, Jul 8, 2011 at 10:10 AM, dan (ddp) <[email protected]> wrote: > What distro/revision? > Any corresponding logs on the manager? > What version of OSSEC? > Are any OSSEC processes on the manager running at 100% cpu? > Are there any firewalls that might be getting in the way? > > On Fri, Jul 8, 2011 at 9:16 AM, gopal krishnan <[email protected]> > wrote: > > Hi, > > > > I have OSSEC server with 5 Linux ossec-agents running, when i retstart > the > > ossec-agent its working fine for sometime after that its going to > inactive > > mode, samething goes to for new agents also. > > > > OSSEC-agent logs: > > > > 2011/07/08 11:12:10 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.5.1'. > > 2011/07/08 11:39:30 ossec-agentd: INFO: Trying to connect to server > > (192.168.5.1:1514). > > 2011/07/08 11:39:40 ossec-agentd(1218): ERROR: Unable to send message to > > server. > > 2011/07/08 11:39:52 ossec-agentd(1218): ERROR: Unable to send message to > > server. > > 2011/07/08 11:39:53 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: 192.168.5.1'. > > 2011/07/08 12:07:31 ossec-agentd: INFO: Trying to connect to server > > (192.168.5.1:1514). > > 2011/07/08 12:07:41 ossec-agentd(1218): ERROR: Unable to send message to > > server. > > 2011/07/08 12:07:53 ossec-agentd(1218): ERROR: Unable to send message to > > server. > > 2011/07/08 12:07:54 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.5.1'. > > 2011/07/08 12:35:50 ossec-agentd: INFO: Trying to connect to server > > (192.168.5.1:1514). > > 2011/07/08 12:36:00 ossec-agentd(1218): ERROR: Unable to send message to > > server. > > 2011/07/08 12:36:12 ossec-agentd(1218): ERROR: Unable to send message to > > server. > > 2011/07/08 12:36:13 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '192.168.5.1'. > > Port is Establised b/w server and agent > > udp 0 0 192.168.5.1:50450 192.168.5.42:1514 > > ESTABLISHED off (0.00/0/0) > > > > > > > > Thanks, > > -Gopal.C >
