Thanks Michael. After copying the contents of a client.keys from an agent into the server client.keys file and removing the rids on the agent, I was able to successfully get them to talk again. However, it's easier to just purge the ossec-agent package from each of the servers and reinstall it and let it do a fresh registration in that case.
I learned my lesson, though. Ensure I'm on the correct server before doing dumb things. Thanks all. On Tue, Jan 27, 2015 at 2:42 PM, Michael Starks < [email protected]> wrote: > On 2015-01-27 14:43, Todd Courtnage wrote: > >> To answer my own question, simply adding the contents of client.keys >> on one of my agents to the the server client.keys file did not work. A >> different error in the logs on the agent: >> >> 2015/01/27 20:34:51 ossec-agentd: WARN: Duplicate error: global: >>> 0, local: 90, saved global: 84, saved local:4166 >>> 2015/01/27 20:34:51 ossec-agentd(1407): ERROR: Duplicated counter >>> for 'xx.yyyy.com [1]'. >>> 2015/01/27 20:34:51 ossec-agentd(1214): WARN: Problem receiving >>> message from ossec.server.com/11.11.11.11 [2]. >>> >> > Delete the rids files, restart the manager and try again. If that doesn't > work, also delete the rids on the agent and restart that too. > > > -- > > --- You received this message because you are subscribed to the Google > Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- *Todd Courtnage* Director of Cloud Computing Chaordix – Crowd Intelligence email: [email protected] office: +1.403.263.2655 toll free: +1.866.263.7775 mob: + 1.403.975.1591 http://www.chaordix.com Follow us on twitter: http://twitter.com/chaordix Our blog: http://www.chaordix.com/blog/ -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
