Michael, What is the ip address you have setup for this agent on the ossec server?
Thanks Richard On 6 March 2012 09:12, Michael Barrett <[email protected]> wrote: > > -bash-3.2# ifconfig > eth0 Link encap:Ethernet HWaddr 00:50:56:9E:74:AA > inet addr:xxx.122.188.10 Bcast:xxx.144.188.255 > Mask:255.255.255.0 > inet6 addr: fe80::250:56ff:fe9e:74aa/64 Scope:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:6178827 errors:0 dropped:0 overruns:0 frame:0 > TX packets:4160605 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:1077461901 (1.0 GiB) TX bytes:1184506761 (1.1 GiB) > Interrupt:59 Base address:0x2000 > > eth1 Link encap:Ethernet HWaddr 00:50:56:9E:46:81 > inet addr:xxx.22.190.10 Bcast:xxx.22.190.255 Mask:255.255.255.0 > inet6 addr: fe80::250:56ff:fe9e:4681/64 Scope:Link > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 > RX packets:436063 errors:0 dropped:0 overruns:0 frame:0 > TX packets:235094 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:1000 > RX bytes:279010171 (266.0 MiB) TX bytes:254848908 (243.0 MiB) > Interrupt:67 Base address:0x2040 > > lo Link encap:Local Loopback > inet addr:127.0.0.1 Mask:255.0.0.0 > inet6 addr: ::1/128 Scope:Host > UP LOOPBACK RUNNING MTU:16436 Metric:1 > RX packets:253 errors:0 dropped:0 overruns:0 frame:0 > TX packets:253 errors:0 dropped:0 overruns:0 carrier:0 > collisions:0 txqueuelen:0 > RX bytes:59380 (57.9 KiB) TX bytes:59380 (57.9 KiB) > > -bash-3.2# netstat -nr > Kernel IP routing table > Destination Gateway Genmask Flags MSS Window irtt > Iface > xxx.22.190.0 0.0.0.0 255.255.255.0 U 0 0 0 > eth1 > xxx.144.188.0 0.0.0.0 255.255.255.0 U 0 0 0 > eth0 > 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 > eth1 > 0.0.0.0 xxx.22.190.254 0.0.0.0 UG 0 0 > 0 eth1 > > > -bash-3.2# tracert ossec.server > traceroute to ossec.server (xxx.xxx.190.48), 30 hops max, 40 byte packets > 1 router (xxx.144.190.245) 0.364 ms 0.426 ms 0.463 ms > 2 ossec.server (xxx.144.190.48) 0.155 ms 0.139 ms 0.133 ms > *____________________________________________* > *Michael Barrett* <[email protected]>* *| *Information Security > Analyst - Lead* | *Mortgage Guaranty Insurance > Corporation*<http://www.mgic.com/> > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > 1.888.601.4440 | * [email protected] > > This message is intended for use only by the person(s) addressed above and > may contain privileged and confidential information. Disclosure or use of > this message by any other person is strictly prohibited. If this message is > received in error, please notify the sender immediately and delete this > message. > > > > From: Richard Worwood <[email protected]> To: [email protected] > Date: 03/06/2012 08:05 AM Subject: Re: [ossec-list] two interfaces Sent > by: [email protected] > ------------------------------ > > > > I would say this is a unix routing issue where the systems own routing > table is telling the machine to use the other interface as it is "closer". > > Michael, > > It would be very useful if you could supply the list with some sort of > network addressing schema for your system along with a copy of the routing > table. > > Would suggest the following as a minimum. > > - ifconfig > - netstat -nr > - traceroute to ossec server > > > > Thanks > > Richard > > > On 6 March 2012 06:39, Michael Barrett > <*[email protected]*<[email protected]>> > wrote: > > I'm not sure. The unix team doesn't seem to think so.... > > Can I assign two keys? I tried putting 2 in the client.keys but that > didn't seem to work. Maybe I did it wrong? > *____________________________________________* * > **Michael Barrett* <[email protected]>* *| *Information Security > Analyst - Lead* | *Mortgage Guaranty Insurance > Corporation*<http://www.mgic.com/> > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > 1.888.601.4440 | * [email protected] > > This message is intended for use only by the person(s) addressed above and > may contain privileged and confidential information. Disclosure or use of > this message by any other person is strictly prohibited. If this message is > received in error, please notify the sender immediately and delete this > message. > > > From: "dan (ddp)" <*[email protected]* <[email protected]>> To: * > [email protected]* <[email protected]> Date: 03/06/2012 > 05:55 AM Subject: Re: [ossec-list] two interfaces Sent by: * > [email protected]* <[email protected]> > > ------------------------------ > > > > > I may be way off base here, but shouldn't the system's routing take > care of this? > > On Mon, Mar 5, 2012 at 1:29 PM, Michael Barrett > <*[email protected]* <[email protected]>> wrote: > > > > I have a RH 5 box with two interfaces on different subnets > > > > The interface that the key is on works fine but the other interface is > > trying to connect to the ossec server and I get a reject error > > > > Is there any way to configure the agent to use only one interface? > > ____________________________________________ > > Michael Barrett | Information Security Analyst - Lead | Mortgage Guaranty > > Insurance Corporation > > 270 E. Kilbourn Ave. | Milwaukee, WI 53202 USA | ( 1.414.347.6271 | 7 > > 1.888.601.4440 | * [email protected] > > > > This message is intended for use only by the person(s) addressed above > and > > may contain privileged and confidential information. Disclosure or use of > > this message by any other person is strictly prohibited. If this message > is > > received in error, please notify the sender immediately and delete this > > message. > > > > >
