Hi Jose, 3d71dacc22e0 etleap/ossec:latest "/usr/bin/supervisor 20 hours ago Up 3 hours 0.0.0.0:1514->1514/udp, 0.0.0.0:1515->1515/tcp ossec
Again, I can use nc to manually send an udp packet to the server from the agent container, so I don't think it's a networking problem. On Friday, August 26, 2016 at 3:57:17 PM UTC-7, jose wrote: > > Hi Ka-hing > > First of all we need to know which command you use to run the container in > order to know which ports are you mapping. > > > Regards > ----------------------- > Jose Luis Ruiz > Wazuh Inc. > [email protected] <javascript:> > > On August 26, 2016 at 5:11:03 PM, Ka-Hing Cheung ([email protected] > <javascript:>) wrote: > >> I have ossec server and agent running in two different docker images. The >> agent is not able to connect to the server: >> >> >> 2016/08/26 20:56:25 ossec-agentd: INFO: Trying to connect to server ( >> ossec.domain/10.0.129.94:1514). >> 2016/08/26 20:56:25 ossec-agentd: INFO: Using IPv4 for: 10.0.129.94 . >> 2016/08/26 20:56:46 ossec-agentd(4101): WARN: Waiting for server reply ( >> not started). Tried: 'ossec.domain/10.0.129.94'. >> >> >> There's no log on the server for the connection attempt. However, if I >> execute nc -u 10.0.129.94 1514 and send a random message, I see this in >> the server log: >> >> >> 2016/08/26 19:19:46 ossec-remoted(1213): WARN: Message from 172.17.42.1 >> not allowed. >> >> >> >> 172.17.42.1 is the IP from the docker interface. I already have this in >> my server ossec.conf: >> >> >> >> <global> >> <white_list>127.0.0.1</white_list> >> <white_list>10.0.0.0/16</white_list> >> <white_list>172.17.0.0/16</white_list> >> </global> >> >> <remote> >> <connection>secure</connection> >> <allowed-ips>10.0.0.0/16</allowed-ips> >> <allowed-ips>172.17.0.0/16</allowed-ips> >> </remote> >> >> >> Any ideas? >> >> - Ka-Hing >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> For more options, visit https://groups.google.com/d/optout. >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
