Thanks Dan, Yes, my server is running Ubuntu 16.04 with OSSEC 2.9RC2 I have a Windows 7 2.9RC2 agent installed, registered, and communicating with the OSSEC Ubuntu server For some reason, though, I can't get it to pull the agent.conf file from the server I have tried restarting the agent service on the Windows 7 agent multiple times, but still get the same: 2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. (line 8). The ossec-monitord service on the Ubuntu server is running If I get it figured out, i'll post back, but for now I'm not sure what the problem could be. Thanks.
On Tuesday, July 26, 2016 at 1:24:59 PM UTC-5, dan (ddpbsd) wrote: > > On Tue, Jul 26, 2016 at 2:11 PM, Craig <[email protected] <javascript:>> > wrote: > > Thanks Dan. The permissions on my server folder: > > > > drwxrwx--- 2 root ossec 4096 Jul 26 12:37 shared > > > > Yes, the contents of agent.conf are in merged.mg on the server > > > > No, I do not even see a merged.mg on the windows agent > > > > I missed that it was a Windows agent in the original message. I don't > have one do check, so I don't know how it really works in this > situation. > I guess try restarting the Windows agent services. I don't know what > the permissions should be for the shared directory in Windows. > Also make sure ossec-monitord is running on the server. I think that > handles this stuff. > > > Thanks for any ideas that may help resolve!! > > > > On Tuesday, July 26, 2016 at 12:59:05 PM UTC-5, dan (ddpbsd) wrote: > >> > >> On Tue, Jul 26, 2016 at 1:29 PM, Craig <[email protected]> wrote: > >> > Environment: Version 2.9RC2 client/server > >> > > >> > When starting my agent service, I get the following: > >> > 2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file > >> > 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. > (line > >> > 8). > >> > > >> > On my server, the file is certainly there and the the > >> > verify-agent-config > >> > script checks out okay > >> > > >> > Any idea on what might be causing this? > >> > > >> > >> Is the file on the agent? > >> What are the permissions of the /var/ossec/etc/shared directory? > >> Do the contents of the agent.conf show up in the server's > >> /var/ossec/etc/shared/merged.mg file? In the agent's? > >> > >> > >> > Thank you! > >> > > >> > -- > >> > > >> > --- > >> > You received this message because you are subscribed to the Google > >> > Groups > >> > "ossec-list" group. > >> > To unsubscribe from this group and stop receiving emails from it, > send > >> > an > >> > email to [email protected]. > >> > For more options, visit https://groups.google.com/d/optout. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
