Could there be another process running on the server that is binding to port 1514? If so, that would explain why the remoted cannot bind to the port.
On Tue, Jul 12, 2011 at 7:40 AM, gopal krishnan <[email protected]>wrote: > Hi Dan, > > Thanks for posting, > > 1) What distro/revision? > OSSEC HIDS v2.4.1 > > 2) OSSEC server version: > > DIRECTORY="/var/ossec" > VERSION="v2.5" > DATE="Tue Jul 5 13:09:21 UTC 2011" > TYPE="server" > 3) Server Side i am seeing the following issue: > > 2011/07/12 10:30:05 ossec-remoted: socketerr (not available). > 2011/07/12 10:30:05 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2011/07/12 10:30:08 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2011/07/12 10:30:08 ossec-remoted(1211): ERROR: Unable to access queue: > '/queue/ossec/queue'. Giving up.. > > 4) Are any OSSEC processes on the manager running at 100% cpu? NO > > 5) Are there any firewalls that might be getting in the way? No Firewall in > place, But when i do the # telnet <host> 1514 its not connecting both from > server and client, But when i restart the client the log saying connected to > the server with port 1514. > > Thank you, > -Gopal.C > > On Fri, Jul 8, 2011 at 10:10 AM, dan (ddp) <[email protected]> wrote: > >> What distro/revision? >> Any corresponding logs on the manager? >> What version of OSSEC? >> Are any OSSEC processes on the manager running at 100% cpu? >> Are there any firewalls that might be getting in the way? >> >> On Fri, Jul 8, 2011 at 9:16 AM, gopal krishnan <[email protected]> >> wrote: >> > Hi, >> > >> > I have OSSEC server with 5 Linux ossec-agents running, when i retstart >> the >> > ossec-agent its working fine for sometime after that its going to >> inactive >> > mode, samething goes to for new agents also. >> > >> > OSSEC-agent logs: >> > >> > 2011/07/08 11:12:10 ossec-agentd(4101): WARN: Waiting for server reply >> (not >> > started). Tried: '192.168.5.1'. >> > 2011/07/08 11:39:30 ossec-agentd: INFO: Trying to connect to server >> > (192.168.5.1:1514). >> > 2011/07/08 11:39:40 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 11:39:52 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 11:39:53 ossec-agentd(4101): WARN: Waiting for server reply >> (not >> > started). Tried: 192.168.5.1'. >> > 2011/07/08 12:07:31 ossec-agentd: INFO: Trying to connect to server >> > (192.168.5.1:1514). >> > 2011/07/08 12:07:41 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:07:53 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:07:54 ossec-agentd(4101): WARN: Waiting for server reply >> (not >> > started). Tried: '192.168.5.1'. >> > 2011/07/08 12:35:50 ossec-agentd: INFO: Trying to connect to server >> > (192.168.5.1:1514). >> > 2011/07/08 12:36:00 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:36:12 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:36:13 ossec-agentd(4101): WARN: Waiting for server reply >> (not >> > started). Tried: '192.168.5.1'. >> > Port is Establised b/w server and agent >> > udp 0 0 192.168.5.1:50450 192.168.5.42:1514 >> > ESTABLISHED off (0.00/0/0) >> > >> > >> > >> > Thanks, >> > -Gopal.C >> > >
