On Thu, May 10, 2012 at 1:17 PM, Dj <[email protected]> wrote: > The VMware host that our OSSEC guest server was running on recently crashed > and ever since the crash one of our agents is not connecting to the OSSEC > server. > > Here is what I have attempted for troubleshooting - > > Created a new agent profile on the Server, extracted the key and configured > the agent with the new key. When this was performed, the server reports > that the agent has never connected to the OSSEC server. > Ran tcpdump on the server to see if the traffic was getting to the server on > port 1514 since the remote agent is on another network with a firewall > between. This agent was working before the VMware host crash. The tcpdump > output shows the UDP traffic getting to the server, but the server is not > responding to the agent. > Ran tcpdump on the server for another agent that is on a different subnet > and results show traffic to the server and back to the agent from the > server. > > Could there be something on the server that is preventing the server from > responding to the agent's connection since the UDP traffic from the agent > was seen in the tcpdump capture on the server, but no response was detected > in the tcpdump capture? > > Are there any debug settings I can enable to try and see further what is > happening on the server? > > We are running OSSEC 2.6 on the server and the agent. > > > > >
It sounds like you're blocking the traffic back. Run tcpdump on the server, does it see the traffic from the problematic agent? Do you see reply traffic from the server? I'm guessing that there's nothing in ossec.log on the server about this agent. Did you delete the old profile for this agent? Enable debug mode: /var/ossec/bin/ossec-control enable debug && /var/ossec/bin/ossec-control restart
