On Jul 31, 2015 5:08 AM, "C.L. Martinez" <[email protected]> wrote: > > On 07/30/2015 03:52 PM, dan (ddp) wrote: >> >> >> On Jul 29, 2015 6:47 AM, "C. L. Martinez" <[email protected] >> <mailto:[email protected]>> wrote: >> > >> > On Wed, Jul 29, 2015 at 9:21 AM, C. L. Martinez <[email protected] >> <mailto:[email protected]>> wrote: >> > > Hi all, >> > > >> > > I am upgrafing my ossec agents to 2.8.2 from 2.8.1 release. But I >> > > have a problem with one agent. In ossec.log's server appears the >> > > following errors: >> > > >> > > 2015/07/29 08:26:38 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > 2015/07/29 08:26:44 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > 2015/07/29 08:26:48 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > 2015/07/29 08:26:53 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > 2015/07/29 08:26:59 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > 2015/07/29 08:27:01 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > 2015/07/29 08:27:07 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > 2015/07/29 08:27:11 ossec-remoted(1403): ERROR: Incorrectly formated >> > > message from '10.196.0.104'. >> > > >> > > >> > > This agent has several ip aliases assigned, but 10.196.0.104 is the >> > > first IP. Maybe is this the problem?? How can I fix it?? >> > >> > Ok, confirmed. This error isn't produced when I remove all ip aliases >> > assigned to this host. At this point, exists some solution? >> > >> >> Is the above IP the correct IP for this agent (in client.keys)? >> > > Yes, it is the correct IP. > >
Try giving the agent a new key. Without really digging into it, I'm not sure where to go. You'd have to find out where in the code the error is being generated,and then use that to figure out why. > -- > > --- You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
