This is the confusing thing Eero...as I mentioned...the IPs that it's listing in the error message do not have any agents on them. I've searched on the servers that are identified and verified no agents exists. I've checked clientkeys and I don't see anything listed. Very confused.
I apologize if I'm not providing more detail then you require but if there is something specific you need to verify or validate I'm happy to do so. On Tue, Apr 7, 2015 at 5:11 PM, Eero Volotinen <[email protected]> wrote: > Is source address incorrect? Ipsec connections, firewalls with nat rules > can cause this kind of issues. > > Try dumping ossec traffic from manager and check that ip source is > correct? > > Eero > 7.4.2015 11.36 ip. "Sinisha Erceg" <[email protected]> kirjoitti: > >> Thanks Eero for your quick reply. I am aware of this and we only use >> either a direct IP address or a subnet range. Would this still occur using >> a subnet? We explicitly do not use ANY. I may have tested this on a box a >> while back but it’s nothing that is currently being used for any of our >> monitored hosts. >> >> >> >> >> >> *Sinisha Erceg* IT Security Analyst >> >> >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- Sinisha Erceg IT Security Analyst WIND Mobile 207 Queen's Quay West, Suite 710 Toronto, ON M5J 1A7 Email: [email protected] Direct: 416-915-3089 <http://www.windmobile.ca> <http://www.windmobile.ca> <http://www.facebook.com/WINDmobile> <http://www.linkedin.com/company/wind-mobile> <http://www.twitter.com/WINDmobile> -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
