On Thu, Jun 11, 2015 at 6:22 PM, H Le <[email protected]> wrote: > Hi, > > I am installing a set of server and agents by yum install the ossec-hids, > ossec-hids-server rpm for manager and ossec-hids, ossec-hids-client for the > agents. > > For the server, I was able to install and set up the listening port 1515 > using this page: > http://ossec-docs.readthedocs.org/en/latest/programs/ossec-authd.html > For the agent, I was able to install and have it talk to the server to set > up the client.keys file following the instruction > http://ossec-docs.readthedocs.org/en/latest/programs/agent-auth.html > However, from the agent's log file /var/ossec/logs/ossec.log, I saw the > error messages: > > 2015/06/11 22:11:31 ossec-agentd: INFO: Trying to connect to server > (192.168.xx.xxx:1514). > 2015/06/11 22:11:31 ossec-agentd: INFO: Using IPv4 for: 192.168.xx.xxx . > 2015/06/11 22:11:41 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2015/06/11 22:11:53 ossec-agentd(1218): ERROR: Unable to send message to > server. > 2015/06/11 22:11:54 ossec-agentd(4101): WARN: Waiting for server reply (not > started). Tried: '192.168.xx.xxx'. > > I took a look at the content of the client.keys file on the agent which > looks like this: > > 1027 agent001 any > 96dfafa4956b1769b074df7ba1c45b57232a5c66ad2d666fe33fcab1d563f163 > > The same context is observed in the client.keys file on the server. > However, there is no file in /var/ossec/queue/agent-info directory. > > Could you please how I can debug and solve this issue? >
Are there any log messages in the manager's ossec.log related to this agent? Did you restart the manager's OSSEC processes after adding the first agent? If you modify the client.keys file and change any to the IP address of the agent, (and restart the OSSEC processes on both systems), does it work? > Thanks. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
