Using 'any' for the IP address for a problem agent seemed to help in another thread suffering from the "Incorrectly formated" problem.
On Tue, Aug 21, 2012 at 11:18 AM, dan (ddp) <[email protected]> wrote: > On Mon, Aug 20, 2012 at 7:38 AM, bw <[email protected]> wrote: >> >> Deleted everything (rm -rf /var/ossec /etc/ossec-init.conf >> /etc/init.d/ossec), got 7987046f6bb1 from JBCheng's repo, that should be >> latest at this time, installed it on server with only one agent, the least >> busy one, no virtualization involved, first restart of the server I got the >> warning again. > > What network devices are between the agent and the server? If the > server is still multi-homed set the listen ip to the one the agent > will connect to. > For reference, so I don't have to dig through this thread again, what > OS/distro/version/architecture is the agent? Is that also running the > latest source?
