On 08/17/2012 15:32, dan (ddp) wrote:
On Fri, Aug 17, 2012 at 2:52 AM, bw <[email protected]> wrote:
Does it work if you don't have it listening to 2 different networks?
No. And when I say no, I mean I stopped everything and started only the
master and the 192.168. agent and I got the same result. I didn't reinstall
everything, the other two agents were still configured, just not started,
master was still listening on all IPs, as it does by default.
So you didn't try? I guess you could try to reinstall, maybe with the
latest source instead of 2.6.
I'll do that too.
I could reinstall everything and try with only one agent if someone thinks
it's relevant.
Might be unrelated, I'll report it here anyway, after leaving it running
with debug enabled for some time I see things like:
ossec-logcollector: socket busy ..
ossec-logcollector: socketerr (not available).
ossec-logcollector(1224): ERROR: Error sending message to queue.
That's on master, OpenBSD.
Is that the server or an agent? I don't have any problems with my
OpenBSD hosts, so that's really odd. What version/platform for
OpenBSD?
Server. Running the 24 July snapshot. Same thing happened with older
snapshots, not sure if it happened on release, too. Going back to
release now is not an option.
and I get emails with
Rule: 504 fired (level 3) -> "Ossec agent disconnected."
There's no mail about the agent connecting back, just another email later
about the same agent disconnecting again. It happens to all the agents.
