(sorry for top-posting but im stuck in the list web-interface)
Protocol and probably port are invalid options on agents. The server defines the port and protocol, not the agent. I tested this on one of my agents: (from ossec.log) 2019/05/25 18:59:54 ossec-agentd(1230): ERROR: Invalid element in the configuration: 'protocol'. 2019/05/25 18:59:54 ossec-agentd(1202): ERROR: Configuration error at '/usr/local/ossec-hids/etc/ossec.conf'. Exiting. 2019/05/25 18:59:54 ossec-agentd(1215): ERROR: No client configured. Exiting. On Saturday, May 25, 2019 at 1:39:05 PM UTC-4, Carlos Lopez wrote: > > Hi all, > > I have installed Ossec 3.3.0 from source in a FreeBSD 12 host to work > as an agent, but when I try to start ossec daemons via ossec-control > script returns this error: > > Starting OSSEC HIDS v3.3.0... > OSSEC analysisd: Testing rules failed. Configuration error. Exiting. > > My ossec.conf in this agent is pretty simple: > > <ossec_config> > <client> > <server> > <address>172.22.59.11</address> > <port>2312</port> > <protocol>udp</protocol> > </server> > </client> > </ossec_config> > > Any tips? > -- > Regards, > C. L. Martinez > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ossec-list/4b587736-0446-4a7a-aca3-b2336a79a7c9%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
