On Mon, Feb 25, 2013 at 2:38 PM, biciunas <[email protected]> wrote: > I upgraded a CentOS 5.9 server from OSSEC 2.6 to 2.7 > After restarting OSSEC server, all the 2.6 agents (both Windows and Linux) > resumed their connections except for 1 Windows agent. The ossec.log showed: > > 2013/02/25 18:18:24 ossec-agent: INFO: Started (pid: 3580). > 2013/02/25 18:18:34 ossec-agent: WARN: Process locked. Waiting for > permission... > 2013/02/25 18:18:45 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '10.xxx.xxx.xxx'. > 2013/02/25 18:18:47 ossec-agent: INFO: Trying to connect to server > (10.xxx.xxx.xxx:1514). > 2013/02/25 18:18:47 ossec-agent: INFO: Using IPv4 for: 10.xxx.xxx.xxx . > 2013/02/25 18:19:08 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: '10.xxx.xxx.xxx'. > 2013/02/25 18:19:28 ossec-agent: INFO: Trying to connect to server > (10.xxx.xxx.xxx:1514). > 2013/02/25 18:19:28 ossec-agent: INFO: Using IPv4 for: 10.xxx.xxx.xxx . > < etc.> > > Wireshark on the windows agent box shows UDP messages going to the correct > IP address, > > The strangest part is that running tethereal on the OSSEC server shows the > requests coming in, But unlike any of the agentt conversations, there's no > outbound messages from the OSSEC server. I can't find anything that remotely > looks like a log entry that may shed any relevant information as to why the > agent request is ignored. > > Starting OSSEC in debug mode does not shed any light on this. > > Anyone have any ideas? > > >
There really should be log messages on the server explaining the problem. Make sure the IP the server sees from the agent matches the IP in the client.keys file for that agent. Make sure the IP is unique in the client.keys file. Delete the agent and re-add it if necessary. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
