I have the following in ossec.conf:

.
.
.
  <remote>
    <connection>syslog</connection>
        <allowed-ips>10.5.4.1</allowed-ips>
        <port>514</port>
  </remote>

  <remote>
    <connection>secure</connection>
  </remote>
.
.
.

And yet when 10.5.4.1 sends a message to the OSSEC server I get this:

WARN: Message from 10.5.4.1 not allowed.


Am I missing something? 

And yes... I've restarted the server.

Reply via email to