The VMware host that our OSSEC guest server was running on recently crashed
and ever since the crash one of our agents is not connecting to the OSSEC
server.
Here is what I have attempted for troubleshooting -
- Created a new agent profile on the Server, extracted the key and
configured the agent with the new key. When this was performed, the server
reports that the agent has never connected to the OSSEC server.
- Ran tcpdump on the server to see if the traffic was getting to the
server on port 1514 since the remote agent is on another network with a
firewall between. This agent was working before the VMware host crash.
The tcpdump output shows the UDP traffic getting to the server, but the
server is not responding to the agent.
- Ran tcpdump on the server for another agent that is on a different
subnet and results show traffic to the server and back to the agent from
the server.
Could there be something on the server that is preventing the server from
responding to the agent's connection since the UDP traffic from the agent
was seen in the tcpdump capture on the server, but no response was detected
in the tcpdump capture?
Are there any debug settings I can enable to try and see further what is
happening on the server?
We are running OSSEC 2.6 on the server and the agent.
