> > If you restart the client, it will get pushed within a minute - assuming > you had restarted the manager so it knows there was a change. > I had this problem with a large install of 4000+ agents in the beginning, > but in general, if the agent is restarted shortly after manager, the files > were pushed within a minute. > This was on 2.6 of course - NOT the AtomiCorp rpms, since I had nothing > but problems with those and keys and all sorts of things. > My suggestion, rebuilding the manager from source. See if that fixes. > > My current test one is the one I built form source, both client and server, version 2.6 Do you still have the client side etc/shared/agent.conf and the client side etc/ossec.conf has some other entry than only the server IP ?
I have only one server, one client for testing and nothing special and it is still refusing to work. Can you send me the ossec source code that works with yours to me, please. Maybe the one at ossec website has something ... Mine one looks like stevek@stevek-mac:~$ md5sum Downloads/ossec-hids-2.6.tar.gz f4140ecf25724b8e6bdcaceaf735138a Downloads/ossec-hids-2.6.tar.gz compile with bare minimum, that is so mysql enable, just run install.sh and the test server is minimum, it is a LXC container using openvz minimum template root file system - after that install gcc to compile and that is it. > ~K > > On Tuesday, July 31, 2012 4:40:02 AM UTC-7, dan (ddpbsd) wrote: >> >> On Tue, Jul 31, 2012 at 7:31 AM, Steve Kieu wrote: >> > I did it and restart the server first and the client later. Should it >> be >> > picked up right away ? >> > >> >> It could take a while for it to be pushed. I think if you run the >> processes in debug mode the transfer will be logged. Running in debug >> mode might be a good idea to see if it logs information on why the >> agent.conf isn't being pushed. >> >> >> -- Steve Kieu
