Hey Dan,
on server I deleted the file in /var/ossec/queue/rids and all files in rid folder on the agent. I restarted both and the problem was solved! many thanks! On Fri, Aug 10, 2012 at 2:01 PM, dan (ddp) <[email protected]> wrote: > On Fri, Aug 10, 2012 at 12:44 PM, Leonardo Bacha Abrantes > <[email protected]> wrote: > > Hi Guys, > > > > I have a virtualized machine which was restored to last snapshot and > after > > that I saw the machine is not able to connect to the server. > > > > I tried to put the key again, but didn't work. > > > > root@myserver:/var/ossec/bin# ./list_agents -n > > mymachine-10.11.171.16 is not active. > > > > -- > > ossec.log on the client: > > > > tail -f /var/ossec/logs/ossec.log > > 2012/08/10 13:34:17 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '10.111.173.1'. > > 2012/08/10 13:35:31 ossec-agentd: INFO: Trying to connect to server > > (10.111.173.1:1514). > > 2012/08/10 13:35:31 ossec-agentd: INFO: Using IPv4 for: 10.111.173.1 . > > 2012/08/10 13:35:52 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '10.111.173.1'. > > 2012/08/10 13:37:24 ossec-agentd: INFO: Trying to connect to server > > (10.111.173.1:1514). > > 2012/08/10 13:37:24 ossec-agentd: INFO: Using IPv4 for: 10.111.173.1 . > > 2012/08/10 13:37:45 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '10.111.173.1'. > > 2012/08/10 13:39:35 ossec-agentd: INFO: Trying to connect to server > > (10.111.173.1:1514). > > 2012/08/10 13:39:35 ossec-agentd: INFO: Using IPv4 for: 10.111.173.1 . > > 2012/08/10 13:39:56 ossec-agentd(4101): WARN: Waiting for server reply > (not > > started). Tried: '10.111.173.1'. > > > > what can be wrong ? > > > > many thanks! > > > > If you didn't delete the agent from the manager and re-add it, fix your > rids. >
