Dan, Thanks for the update,
Which standard version i can go with now? Thanks, -Gopal.C On Wed, Jul 13, 2011 at 7:46 AM, dan (ddp) <[email protected]> wrote: > On Tue, Jul 12, 2011 at 7:40 AM, gopal krishnan > <[email protected]> wrote: > > Hi Dan, > > > > Thanks for posting, > > > > 1) What distro/revision? > > OSSEC HIDS v2.4.1 > > > > You should upgrade. :) > > > 2) OSSEC server version: > > > > DIRECTORY="/var/ossec" > > VERSION="v2.5" > > DATE="Tue Jul 5 13:09:21 UTC 2011" > > TYPE="server" > > 3) Server Side i am seeing the following issue: > > > > 2011/07/12 10:30:05 ossec-remoted: socketerr (not available). > > Any errors before this? You should also try turning on debug mode. > That might provide more info. > > > 2011/07/12 10:30:05 ossec-remoted(1210): ERROR: Queue > '/queue/ossec/queue' > > not accessible: 'Connection refused'. > > 2011/07/12 10:30:08 ossec-remoted(1210): ERROR: Queue > '/queue/ossec/queue' > > not accessible: 'Connection refused'. > > 2011/07/12 10:30:08 ossec-remoted(1211): ERROR: Unable to access queue: > > '/queue/ossec/queue'. Giving up.. > > > > 4) Are any OSSEC processes on the manager running at 100% cpu? NO > > > > 5) Are there any firewalls that might be getting in the way? No Firewall > in > > place, But when i do the # telnet <host> 1514 its not connecting both > from > > server and client, But when i restart the client the log saying connected > to > > the server with port 1514. > > > > OSSEC uses udp. > > > Thank you, > > -Gopal.C > > > > On Fri, Jul 8, 2011 at 10:10 AM, dan (ddp) <[email protected]> wrote: > >> > >> What distro/revision? > >> Any corresponding logs on the manager? > >> What version of OSSEC? > >> Are any OSSEC processes on the manager running at 100% cpu? > >> Are there any firewalls that might be getting in the way? > >> > >> On Fri, Jul 8, 2011 at 9:16 AM, gopal krishnan < > [email protected]> > >> wrote: > >> > Hi, > >> > > >> > I have OSSEC server with 5 Linux ossec-agents running, when i retstart > >> > the > >> > ossec-agent its working fine for sometime after that its going to > >> > inactive > >> > mode, samething goes to for new agents also. > >> > > >> > OSSEC-agent logs: > >> > > >> > 2011/07/08 11:12:10 ossec-agentd(4101): WARN: Waiting for server reply > >> > (not > >> > started). Tried: '192.168.5.1'. > >> > 2011/07/08 11:39:30 ossec-agentd: INFO: Trying to connect to server > >> > (192.168.5.1:1514). > >> > 2011/07/08 11:39:40 ossec-agentd(1218): ERROR: Unable to send message > to > >> > server. > >> > 2011/07/08 11:39:52 ossec-agentd(1218): ERROR: Unable to send message > to > >> > server. > >> > 2011/07/08 11:39:53 ossec-agentd(4101): WARN: Waiting for server reply > >> > (not > >> > started). Tried: 192.168.5.1'. > >> > 2011/07/08 12:07:31 ossec-agentd: INFO: Trying to connect to server > >> > (192.168.5.1:1514). > >> > 2011/07/08 12:07:41 ossec-agentd(1218): ERROR: Unable to send message > to > >> > server. > >> > 2011/07/08 12:07:53 ossec-agentd(1218): ERROR: Unable to send message > to > >> > server. > >> > 2011/07/08 12:07:54 ossec-agentd(4101): WARN: Waiting for server reply > >> > (not > >> > started). Tried: '192.168.5.1'. > >> > 2011/07/08 12:35:50 ossec-agentd: INFO: Trying to connect to server > >> > (192.168.5.1:1514). > >> > 2011/07/08 12:36:00 ossec-agentd(1218): ERROR: Unable to send message > to > >> > server. > >> > 2011/07/08 12:36:12 ossec-agentd(1218): ERROR: Unable to send message > to > >> > server. > >> > 2011/07/08 12:36:13 ossec-agentd(4101): WARN: Waiting for server reply > >> > (not > >> > started). Tried: '192.168.5.1'. > >> > Port is Establised b/w server and agent > >> > udp 0 0 192.168.5.1:50450 192.168.5.42:1514 > >> > ESTABLISHED off (0.00/0/0) > >> > > >> > > >> > > >> > Thanks, > >> > -Gopal.C > > > > >
