On Tue, Jul 12, 2011 at 7:40 AM, gopal krishnan <[email protected]> wrote: > Hi Dan, > > Thanks for posting, > > 1) What distro/revision? > OSSEC HIDS v2.4.1 >
You should upgrade. :) > 2) OSSEC server version: > > DIRECTORY="/var/ossec" > VERSION="v2.5" > DATE="Tue Jul 5 13:09:21 UTC 2011" > TYPE="server" > 3) Server Side i am seeing the following issue: > > 2011/07/12 10:30:05 ossec-remoted: socketerr (not available). Any errors before this? You should also try turning on debug mode. That might provide more info. > 2011/07/12 10:30:05 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2011/07/12 10:30:08 ossec-remoted(1210): ERROR: Queue '/queue/ossec/queue' > not accessible: 'Connection refused'. > 2011/07/12 10:30:08 ossec-remoted(1211): ERROR: Unable to access queue: > '/queue/ossec/queue'. Giving up.. > > 4) Are any OSSEC processes on the manager running at 100% cpu? NO > > 5) Are there any firewalls that might be getting in the way? No Firewall in > place, But when i do the # telnet <host> 1514 its not connecting both from > server and client, But when i restart the client the log saying connected to > the server with port 1514. > OSSEC uses udp. > Thank you, > -Gopal.C > > On Fri, Jul 8, 2011 at 10:10 AM, dan (ddp) <[email protected]> wrote: >> >> What distro/revision? >> Any corresponding logs on the manager? >> What version of OSSEC? >> Are any OSSEC processes on the manager running at 100% cpu? >> Are there any firewalls that might be getting in the way? >> >> On Fri, Jul 8, 2011 at 9:16 AM, gopal krishnan <[email protected]> >> wrote: >> > Hi, >> > >> > I have OSSEC server with 5 Linux ossec-agents running, when i retstart >> > the >> > ossec-agent its working fine for sometime after that its going to >> > inactive >> > mode, samething goes to for new agents also. >> > >> > OSSEC-agent logs: >> > >> > 2011/07/08 11:12:10 ossec-agentd(4101): WARN: Waiting for server reply >> > (not >> > started). Tried: '192.168.5.1'. >> > 2011/07/08 11:39:30 ossec-agentd: INFO: Trying to connect to server >> > (192.168.5.1:1514). >> > 2011/07/08 11:39:40 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 11:39:52 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 11:39:53 ossec-agentd(4101): WARN: Waiting for server reply >> > (not >> > started). Tried: 192.168.5.1'. >> > 2011/07/08 12:07:31 ossec-agentd: INFO: Trying to connect to server >> > (192.168.5.1:1514). >> > 2011/07/08 12:07:41 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:07:53 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:07:54 ossec-agentd(4101): WARN: Waiting for server reply >> > (not >> > started). Tried: '192.168.5.1'. >> > 2011/07/08 12:35:50 ossec-agentd: INFO: Trying to connect to server >> > (192.168.5.1:1514). >> > 2011/07/08 12:36:00 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:36:12 ossec-agentd(1218): ERROR: Unable to send message to >> > server. >> > 2011/07/08 12:36:13 ossec-agentd(4101): WARN: Waiting for server reply >> > (not >> > started). Tried: '192.168.5.1'. >> > Port is Establised b/w server and agent >> > udp 0 0 192.168.5.1:50450 192.168.5.42:1514 >> > ESTABLISHED off (0.00/0/0) >> > >> > >> > >> > Thanks, >> > -Gopal.C > >
