2.6 is all but released.
On Jul 13, 2011 8:57 AM, "gopal krishnan" <[email protected]> wrote:
> Dan,
>
> Thanks for the update,
>
> Which standard version i can go with now?
>
> Thanks,
> -Gopal.C
>
>
>
>
> On Wed, Jul 13, 2011 at 7:46 AM, dan (ddp) <[email protected]> wrote:
>
>> On Tue, Jul 12, 2011 at 7:40 AM, gopal krishnan
>> <[email protected]> wrote:
>> > Hi Dan,
>> >
>> > Thanks for posting,
>> >
>> > 1) What distro/revision?
>> > OSSEC HIDS v2.4.1
>> >
>>
>> You should upgrade. :)
>>
>> > 2) OSSEC server version:
>> >
>> > DIRECTORY="/var/ossec"
>> > VERSION="v2.5"
>> > DATE="Tue Jul 5 13:09:21 UTC 2011"
>> > TYPE="server"
>> > 3) Server Side i am seeing the following issue:
>> >
>> > 2011/07/12 10:30:05 ossec-remoted: socketerr (not available).
>>
>> Any errors before this? You should also try turning on debug mode.
>> That might provide more info.
>>
>> > 2011/07/12 10:30:05 ossec-remoted(1210): ERROR: Queue
>> '/queue/ossec/queue'
>> > not accessible: 'Connection refused'.
>> > 2011/07/12 10:30:08 ossec-remoted(1210): ERROR: Queue
>> '/queue/ossec/queue'
>> > not accessible: 'Connection refused'.
>> > 2011/07/12 10:30:08 ossec-remoted(1211): ERROR: Unable to access queue:
>> > '/queue/ossec/queue'. Giving up..
>> >
>> > 4) Are any OSSEC processes on the manager running at 100% cpu? NO
>> >
>> > 5) Are there any firewalls that might be getting in the way? No
Firewall
>> in
>> > place, But when i do the # telnet <host> 1514 its not connecting both
>> from
>> > server and client, But when i restart the client the log saying
connected
>> to
>> > the server with port 1514.
>> >
>>
>> OSSEC uses udp.
>>
>> > Thank you,
>> > -Gopal.C
>> >
>> > On Fri, Jul 8, 2011 at 10:10 AM, dan (ddp) <[email protected]> wrote:
>> >>
>> >> What distro/revision?
>> >> Any corresponding logs on the manager?
>> >> What version of OSSEC?
>> >> Are any OSSEC processes on the manager running at 100% cpu?
>> >> Are there any firewalls that might be getting in the way?
>> >>
>> >> On Fri, Jul 8, 2011 at 9:16 AM, gopal krishnan <
>> [email protected]>
>> >> wrote:
>> >> > Hi,
>> >> >
>> >> > I have OSSEC server with 5 Linux ossec-agents running, when i
retstart
>> >> > the
>> >> > ossec-agent its working fine for sometime after that its going to
>> >> > inactive
>> >> > mode, samething goes to for new agents also.
>> >> >
>> >> > OSSEC-agent logs:
>> >> >
>> >> > 2011/07/08 11:12:10 ossec-agentd(4101): WARN: Waiting for server
reply
>> >> > (not
>> >> > started). Tried: '192.168.5.1'.
>> >> > 2011/07/08 11:39:30 ossec-agentd: INFO: Trying to connect to server
>> >> > (192.168.5.1:1514).
>> >> > 2011/07/08 11:39:40 ossec-agentd(1218): ERROR: Unable to send
message
>> to
>> >> > server.
>> >> > 2011/07/08 11:39:52 ossec-agentd(1218): ERROR: Unable to send
message
>> to
>> >> > server.
>> >> > 2011/07/08 11:39:53 ossec-agentd(4101): WARN: Waiting for server
reply
>> >> > (not
>> >> > started). Tried: 192.168.5.1'.
>> >> > 2011/07/08 12:07:31 ossec-agentd: INFO: Trying to connect to server
>> >> > (192.168.5.1:1514).
>> >> > 2011/07/08 12:07:41 ossec-agentd(1218): ERROR: Unable to send
message
>> to
>> >> > server.
>> >> > 2011/07/08 12:07:53 ossec-agentd(1218): ERROR: Unable to send
message
>> to
>> >> > server.
>> >> > 2011/07/08 12:07:54 ossec-agentd(4101): WARN: Waiting for server
reply
>> >> > (not
>> >> > started). Tried: '192.168.5.1'.
>> >> > 2011/07/08 12:35:50 ossec-agentd: INFO: Trying to connect to server
>> >> > (192.168.5.1:1514).
>> >> > 2011/07/08 12:36:00 ossec-agentd(1218): ERROR: Unable to send
message
>> to
>> >> > server.
>> >> > 2011/07/08 12:36:12 ossec-agentd(1218): ERROR: Unable to send
message
>> to
>> >> > server.
>> >> > 2011/07/08 12:36:13 ossec-agentd(4101): WARN: Waiting for server
reply
>> >> > (not
>> >> > started). Tried: '192.168.5.1'.
>> >> > Port is Establised b/w server and agent
>> >> > udp 0 0 192.168.5.1:50450 192.168.5.42:1514
>> >> > ESTABLISHED off (0.00/0/0)
>> >> >
>> >> >
>> >> >
>> >> > Thanks,
>> >> > -Gopal.C
>> >
>> >
>>
