Hi Carlos, Looking your logs seems like you have a problem with Duplicated counters, i think you have two options to fix this error:
1.- You can edit the file /var/ossec/etc/internal-options.conf check the value *remoted.verify_msg_id* and set to 0 in both sides, manager and agents and restart to apply the changes. 2.- You can follow this manual http://ossec-docs.readthedocs.io/en/latest/faq/unexpected.html#fixing-duplicate-errors <http://ossec-docs.readthedocs.io/en/latest/faq/unexpected.html> but keep in mind that it could happen again in the future. I hope it helps!. Regards ----------------------- Jose Luis Ruiz Wazuh Inc. [email protected] On August 3, 2017 at 7:48:10 PM, Carlos Islas ([email protected]) wrote: 017/08/03 08:27:40 <http://airmail.calendar/2017-08-03 08:27:40 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 08:27:46 <http://airmail.calendar/2017-08-03 08:27:46 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 08:27:50 <http://airmail.calendar/2017-08-03 08:27:50 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 08:27:55 <http://airmail.calendar/2017-08-03 08:27:55 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 08:28:01 <http://airmail.calendar/2017-08-03 08:28:01 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 08:37:19 <http://airmail.calendar/2017-08-03 08:37:19 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 08:37:25 <http://airmail.calendar/2017-08-03 08:37:25 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 08:37:29 <http://airmail.calendar/2017-08-03 08:37:29 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 08:37:34 <http://airmail.calendar/2017-08-03 08:37:34 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 08:37:40 <http://airmail.calendar/2017-08-03 08:37:40 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 10:48:30 <http://airmail.calendar/2017-08-03 10:48:30 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 10:48:36 <http://airmail.calendar/2017-08-03 10:48:36 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 10:48:40 <http://airmail.calendar/2017-08-03 10:48:40 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 10:48:45 <http://airmail.calendar/2017-08-03 10:48:45 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 10:48:51 <http://airmail.calendar/2017-08-03 10:48:51 GMT+2> ossec-remoted(1407): ERROR: Duplicated counter for 'posmexng s'. 2017/08/03 11:09:45 <http://airmail.calendar/2017-08-03 11:09:45 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 11:09:51 <http://airmail.calendar/2017-08-03 11:09:51 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 11:09:55 <http://airmail.calendar/2017-08-03 11:09:55 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 11:10:00 <http://airmail.calendar/2017-08-03 11:10:00 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. 2017/08/03 11:10:06 <http://airmail.calendar/2017-08-03 11:10:06 GMT+2> ossec-remoted(1403): ERROR: Incorrectly formated message fro m '172.27.1.122'. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
