On Tue, Jul 26, 2016 at 2:11 PM, Craig <[email protected]> wrote: > Thanks Dan. The permissions on my server folder: > > drwxrwx--- 2 root ossec 4096 Jul 26 12:37 shared > > Yes, the contents of agent.conf are in merged.mg on the server > > No, I do not even see a merged.mg on the windows agent >
I missed that it was a Windows agent in the original message. I don't have one do check, so I don't know how it really works in this situation. I guess try restarting the Windows agent services. I don't know what the permissions should be for the shared directory in Windows. Also make sure ossec-monitord is running on the server. I think that handles this stuff. > Thanks for any ideas that may help resolve!! > > On Tuesday, July 26, 2016 at 12:59:05 PM UTC-5, dan (ddpbsd) wrote: >> >> On Tue, Jul 26, 2016 at 1:29 PM, Craig <[email protected]> wrote: >> > Environment: Version 2.9RC2 client/server >> > >> > When starting my agent service, I get the following: >> > 2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file >> > 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. (line >> > 8). >> > >> > On my server, the file is certainly there and the the >> > verify-agent-config >> > script checks out okay >> > >> > Any idea on what might be causing this? >> > >> >> Is the file on the agent? >> What are the permissions of the /var/ossec/etc/shared directory? >> Do the contents of the agent.conf show up in the server's >> /var/ossec/etc/shared/merged.mg file? In the agent's? >> >> >> > Thank you! >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
