Hi, I have a same problem to you. I have ossec server on ubuntu, and a agent on XP (virtual macine on ubuntu). My agent can not connect to server. Please help me fot solution. Thanks very much
Hoa On Apr 11, 9:08 pm, "dan (ddp)" <[email protected]> wrote: > I think the rids files are named after theagentid number. So if you > move the one named after the misbehavingagent'sid # out of the way > (you don't have to move it to theagentor anything) and start the > ossec processes it "should" work. > > On Wed, Apr 11, 2012 at 9:54 AM, jack.23783 <[email protected]> wrote: > > You got me. > > So what should I do to get the appropriate rids file? > > It still didn't work after I copied manager's rids toagent, vice versa. > > Thanks. > > > On Wed, Apr 11, 2012 at 8:51 PM, dan (ddp) <[email protected]> wrote: > > >> So theagentwas running fine, then you reverted to a previous > >> snapshot and it stopped working? > >> Your rids are messed up. You got theagentand manager out of sync. > >> Stop the OSSEC processes on the manager and theagent, move the > >> appropriate rids file in /var/ossec/queue/rids, then start the > >> processes again. > >> Or remove theagentand issue a new key. > > >> On Wed, Apr 11, 2012 at 3:59 AM, <[email protected]> wrote: > >> > Hi, > >> > I have ossecserveron ubuntu, and anagent on windows xp. windows xp > >> > is a virtual machine. > >> > At beginning, everything is OK. But when I chang virtual machine to > >> > older snapshot (itsagentworks fine when I took this snapshot), the > >> >agentcan notconnecttoserveronly more. It's log is as follow: > > >> > 2012/04/11 15:17:59 ossec-agent: INFO: Started (pid: 6404). > >> > 2012/04/11 15:18:09 ossec-agent: WARN: Process locked. Waiting for > >> > permission... > >> > 2012/04/11 15:18:20 ossec-agent(4101): WARN: Waiting forserverreply > >> > (not started). Tried: '202.197.1.100'. > >> > 2012/04/11 15:18:22 ossec-agent: INFO: Trying toconnecttoserver > >> > (202.197.1.100:1514). > >> > 2012/04/11 15:18:22 ossec-agent: INFO: Using IPv4 for: 202.197.1.100 . > >> > 2012/04/11 15:18:43 ossec-agent(4101): WARN: Waiting forserverreply > >> > (not started). Tried: '202.197.1.100'. > > >> > What's the problem with it? > >> > Gratitude!
