On Thu, Aug 16, 2012 at 9:25 PM, Adriel Desautels <[email protected]> wrote: > I have the following in ossec.conf: > > . > . > . > <remote> > <connection>syslog</connection> > <allowed-ips>10.5.4.1</allowed-ips> > <port>514</port> > </remote> > > <remote> > <connection>secure</connection> > </remote> > . > . > . > > And yet when 10.5.4.1 sends a message to the OSSEC server I get this: > > WARN: Message from 10.5.4.1 not allowed. > > > Am I missing something? > > And yes... I've restarted the server.
Please provide your entire ossec.conf.
