On Fri, Aug 17, 2012 at 2:52 AM, bw <[email protected]> wrote: >> >> Does it work if you don't have it listening to 2 different networks? >> > > No. And when I say no, I mean I stopped everything and started only the > master and the 192.168. agent and I got the same result. I didn't reinstall > everything, the other two agents were still configured, just not started, > master was still listening on all IPs, as it does by default.
So you didn't try? I guess you could try to reinstall, maybe with the latest source instead of 2.6. > I could reinstall everything and try with only one agent if someone thinks > it's relevant. > > Might be unrelated, I'll report it here anyway, after leaving it running > with debug enabled for some time I see things like: > > ossec-logcollector: socket busy .. > ossec-logcollector: socketerr (not available). > ossec-logcollector(1224): ERROR: Error sending message to queue. > > That's on master, OpenBSD. > Is that the server or an agent? I don't have any problems with my OpenBSD hosts, so that's really odd. What version/platform for OpenBSD? > and I get emails with > > Rule: 504 fired (level 3) -> "Ossec agent disconnected." > > There's no mail about the agent connecting back, just another email later > about the same agent disconnecting again. It happens to all the agents.
