Re: [ossec-list] firewall --> ossec via UDP 514 : "WARN: Message from 10.5.4.1 not allowed."

[JB]

The allowed value for <remote><connection> is either 'secure' or 'syslog' 
according to http://www.ossec.net/doc/syntax/head_ossec_config.remote.html

It seems strange that you have both values in your ossec.conf. 
Try get rid of the second <remote> below.

  <remote>
    <connection>syslog</connection>
        <allowed-ips>10.5.4.1</allowed-ips>
        <port>514</port>
  </remote>

  <remote>
    <connection>secure</connection>
  </remote>