If the IPs are in the same subnet setup the agent with a CIDR address for its IP (XXX.0/24). If not, you should be able to handle this with a custom route (or use "any" as the IP).
On Thu, Oct 20, 2011 at 11:27 AM, Culver, Michael <[email protected]> wrote: > I have a sever that has two IP addresses on separate network interfaces. So > something like this. > > Server IP - x.x.x.1 > Server website IP - x.x.x.2 > > DNS for both the server and the website are different. > > When I set the agent up to use the server IP (x.x.x.1). It reports > "ossec-remoted(1213): WARN: Message from x.x.x.2 not allowed" > > When I set the agent to use the website IP (x.x.x.2). It reports > "ossec-remoted(1403): ERROR: Incorrectly formatted message from 'x.x.x.2'. > > Ideally it should not be using the website IP. But when the agent is talking > to the ossec server it communicates as x.x.x.2. > > Has anyone seen anything like this? > > > > >
