On Thu, Dec 11, 2014 at 9:35 PM, David Lang <[email protected]> wrote: > On Thu, 11 Dec 2014, dan (ddp) wrote: > >> On Dec 11, 2014 3:48 PM, "David Lang" <[email protected]> wrote: >>> >>> >>> I've got a couple machines that the agent logs say have connected, and >>> server logs show "Assigning counter for X" entries, but agent_control -l >>> keeps claiming that they have never connected. >>> >>> I've tried removing these servers, creating new keys and deploying from >>> scratch (with rid/* removal on the agents) and it does not seem to have >>> solved the problem >>> >>> This is with v2.8 (Windows agents) >>> >>> Any suggestions? >>> >> >> Look for an agent_info directory. Check the perms or move the non working >> entry and restart the agent. > > > I found a .agent_info file. removing that and restarting fixed the two > systems that claimed to have connected but weren't showing up. > > Now I've got one left that is sending packets (which I see in tcpdump on the > server), but the server isn't responding. nothing in the logs, even with the > remoted debug level = 2 >
I don't know how much that actually helps. Try `/var/ossec/bin/ossec-control enable debug && /var/ossec/bin/ossec-control restart` on the manager. Verify the key. Verify the IP address in manage_agents. Verify that the IP is unique and that the correct IP is making it to the manager (no NAT). > David Lang -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
