On Sun, Apr 22, 2018 at 9:52 PM, Cooper <[email protected]> wrote: > Why are the ossec clients trying to connect to the server using port 1514, > when the default port (and the port they registered with) is 1515, which is > also the port the server is listening on? > > 2018/04/22 20:49:16 INFO: Connected to <server IP> at address <server IP>, > port 1514 > 2018/04/22 20:49:26 ossec-agentd(1218): ERROR: Unable to send message to > 'server'. > 2018/04/22 20:49:38 ossec-agentd(1218): ERROR: Unable to send message to > 'server'. > > Not sure why it's saying it was able to successfully connect, since there is > NOTHING listening on that port. >
ossec-remoted listens on 1514 by default. If that's been changed, the agents will have to be changed as well. ossec-authd usually uses 1515, which is what the agents register to. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
