Hi What would try is to reconfiguring that agent and server relationship. This time, don't define the specific IP for the agent, instead when it asks you for the IP set it to ANY
You might also have to clear out the queue dir but since it's new, I'd recommend just start fresh. Remove the agent from the manager, reinstall the agent, but this time set the ip to any, that should work. If it doesn't, you'll want to do a tcpdump on UDP 1514 to see if it's accepting traffic, maybe even check your firewall make sure it's allowed, but as it was it should. Tony On Wednesday, July 31, 2013 4:35:08 AM UTC-7, Macaulay Dias Souza wrote: > > ID: 001, Name: MAIL, IP: 172.16.1.8, Active > ID: 002, Name: CMA02, IP: 172.16.1.226, Disconnected > > I recently installed the CMA02, worked for about 2 days and stopped > working, restart does not help him. The ip in it is exactly the same as is > in the other and all are part of the same network. Can anyone help me? Here > is his log: > > > > 2013/07/31 08:39:07 ossec-syscheckd: INFO: Started (pid: 19673). >> 2013/07/31 08:39:07 ossec-rootcheck: INFO: Started (pid: 19673). >> 2013/07/31 08:39:07 ossec-syscheckd: INFO: Monitoring directory: '/etc'. >> 2013/07/31 08:39:07 ossec-syscheckd: INFO: Monitoring directory: >> '/usr/bin'. >> 2013/07/31 08:39:07 ossec-syscheckd: INFO: Monitoring directory: >> '/usr/sbin'. >> 2013/07/31 08:39:07 ossec-syscheckd: INFO: Monitoring directory: '/bin'. >> 2013/07/31 08:39:07 ossec-syscheckd: INFO: Monitoring directory: '/sbin'. >> 2013/07/31 08:39:09 ossec-logcollector(1950): INFO: Analyzing file: >> '/var/log/messages'. >> 2013/07/31 08:39:09 ossec-logcollector(1950): INFO: Analyzing file: >> '/var/log/auth.log'. >> 2013/07/31 08:39:09 ossec-logcollector(1950): INFO: Analyzing file: >> '/var/log/syslog'. >> 2013/07/31 08:39:09 ossec-logcollector(1950): INFO: Analyzing file: >> '/var/log/mail.info'. >> 2013/07/31 08:39:09 ossec-logcollector(1950): INFO: Analyzing file: >> '/var/log/dpkg.log'. >> 2013/07/31 08:39:09 ossec-logcollector(1950): INFO: Analyzing file: >> '/var/log/proftpd/proftpd.log'. >> 2013/07/31 08:39:09 ossec-logcollector: INFO: Started (pid: 19669). >> 2013/07/31 08:39:19 ossec-logcollector: WARN: Process locked. Waiting for >> permission... >> 2013/07/31 08:39:24 ossec-agentd(4101): WARN: Waiting for server reply >> (not started). Tried: '172.16.1.18'. >> 2013/07/31 08:39:26 ossec-agentd: INFO: Trying to connect to server ( >> 172.16.1.18:1514). >> 2013/07/31 08:39:26 ossec-agentd: INFO: Using IPv4 for: 172.16.1.18 . >> 2013/07/31 08:39:47 ossec-agentd(4101): WARN: Waiting for server reply >> (not started). Tried: '172.16.1.18'. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
