I have the following in ossec.conf:
.
.
.
<remote>
<connection>syslog</connection>
<allowed-ips>10.5.4.1</allowed-ips>
<port>514</port>
</remote>
<remote>
<connection>secure</connection>
</remote>
.
.
.
And yet when 10.5.4.1 sends a message to the OSSEC server I get this:
WARN: Message from 10.5.4.1 not allowed.
Am I missing something?
And yes... I've restarted the server.
