Tried this also. Didn't work. My agents are Windows 2008. I don't believe this has anything to do with it as the Windows boxes on the same subnet as the server are getting responses back from the server.
On Jan 26, 1:57 pm, Kat <[email protected]> wrote: > I keep seeing these from more than one person - with over 6000 agents > in 3 DC's I can tell you I have found the quickest solution: > > 1. Although this is frowned upon - on the agents - wipe /var/ossec/ > queue/rids/ on each of the offending agents > 2. find the agent ID in the same folder on the server and rm > 3. restart the agent. (restart the server if you feel like it) > > Poof - connections made - everyone happy. > I constantly get the "Trying..." errors, normally after a new install. > I have a mix of Solaris, AIX, HP-UX, Linux and Windoze.. The uni* > boxes are the ones that do this and I can find no rhyme or reason in > why they do it. The funny thing is, sniffing it shows the traffic, but > the server simply refuses to make the connection until I wipe the RIDS > folders/identities. > > This works every time - with a couple of very rare times when I have > to do this AND re-create the key. > > Try this and see if it helps.
