On Tue, Jul 26, 2016 at 2:41 PM, Craig <[email protected]> wrote: > Thanks Dan, > Yes, my server is running Ubuntu 16.04 with OSSEC 2.9RC2 > I have a Windows 7 2.9RC2 agent installed, registered, and communicating > with the OSSEC Ubuntu server > For some reason, though, I can't get it to pull the agent.conf file from the > server > I have tried restarting the agent service on the Windows 7 agent multiple > times, but still get the same: > 2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file > 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. (line 8). > The ossec-monitord service on the Ubuntu server is running > If I get it figured out, i'll post back, but for now I'm not sure what the > problem could be. > Thanks. >
You could try creating merged.mg on the agent. Because it's Windows I don't know the expected permissions off hand. > > On Tuesday, July 26, 2016 at 1:24:59 PM UTC-5, dan (ddpbsd) wrote: >> >> On Tue, Jul 26, 2016 at 2:11 PM, Craig <[email protected]> wrote: >> > Thanks Dan. The permissions on my server folder: >> > >> > drwxrwx--- 2 root ossec 4096 Jul 26 12:37 shared >> > >> > Yes, the contents of agent.conf are in merged.mg on the server >> > >> > No, I do not even see a merged.mg on the windows agent >> > >> >> I missed that it was a Windows agent in the original message. I don't >> have one do check, so I don't know how it really works in this >> situation. >> I guess try restarting the Windows agent services. I don't know what >> the permissions should be for the shared directory in Windows. >> Also make sure ossec-monitord is running on the server. I think that >> handles this stuff. >> >> > Thanks for any ideas that may help resolve!! >> > >> > On Tuesday, July 26, 2016 at 12:59:05 PM UTC-5, dan (ddpbsd) wrote: >> >> >> >> On Tue, Jul 26, 2016 at 1:29 PM, Craig <[email protected]> wrote: >> >> > Environment: Version 2.9RC2 client/server >> >> > >> >> > When starting my agent service, I get the following: >> >> > 2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file >> >> > 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. >> >> > (line >> >> > 8). >> >> > >> >> > On my server, the file is certainly there and the the >> >> > verify-agent-config >> >> > script checks out okay >> >> > >> >> > Any idea on what might be causing this? >> >> > >> >> >> >> Is the file on the agent? >> >> What are the permissions of the /var/ossec/etc/shared directory? >> >> Do the contents of the agent.conf show up in the server's >> >> /var/ossec/etc/shared/merged.mg file? In the agent's? >> >> >> >> >> >> > Thank you! >> >> > >> >> > -- >> >> > >> >> > --- >> >> > You received this message because you are subscribed to the Google >> >> > Groups >> >> > "ossec-list" group. >> >> > To unsubscribe from this group and stop receiving emails from it, >> >> > send >> >> > an >> >> > email to [email protected]. >> >> > For more options, visit https://groups.google.com/d/optout. >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
