I keep seeing these from more than one person - with over 6000 agents in 3 DC's I can tell you I have found the quickest solution:
1. Although this is frowned upon - on the agents - wipe /var/ossec/ queue/rids/ on each of the offending agents 2. find the agent ID in the same folder on the server and rm 3. restart the agent. (restart the server if you feel like it) Poof - connections made - everyone happy. I constantly get the "Trying..." errors, normally after a new install. I have a mix of Solaris, AIX, HP-UX, Linux and Windoze.. The uni* boxes are the ones that do this and I can find no rhyme or reason in why they do it. The funny thing is, sniffing it shows the traffic, but the server simply refuses to make the connection until I wipe the RIDS folders/identities. This works every time - with a couple of very rare times when I have to do this AND re-create the key. Try this and see if it helps.
