Does it work if you don't have it listening to 2 different networks?
No. And when I say no, I mean I stopped everything and started only the
master and the 192.168. agent and I got the same result. I didn't
reinstall everything, the other two agents were still configured, just
not started, master was still listening on all IPs, as it does by default.
I could reinstall everything and try with only one agent if someone
thinks it's relevant.
Might be unrelated, I'll report it here anyway, after leaving it running
with debug enabled for some time I see things like:
ossec-logcollector: socket busy ..
ossec-logcollector: socketerr (not available).
ossec-logcollector(1224): ERROR: Error sending message to queue.
That's on master, OpenBSD.
and I get emails with
Rule: 504 fired (level 3) -> "Ossec agent disconnected."
There's no mail about the agent connecting back, just another email
later about the same agent disconnecting again. It happens to all the
agents.
