Re: [ossec-list] ERROR: Invalid ID for the source ip: 'x.x.x.x'

2015-04-08 Thread Sinisha Erceg
This is the confusing thing Eero...as I mentioned...the IPs that it's listing in the error message do not have any agents on them. I've searched on the servers that are identified and verified no agents exists. I've checked clientkeys and I don't see anything listed. Very confused. I

[ossec-list] ERROR: Invalid ID for the source ip: 'x.x.x.x'

2015-04-07 Thread Sinisha Erceg
Hello, I apologize in advance for lack of understanding and I've attempted to look through the forums but I have inherited OSSEC from a predecessor and I have limited *nix experience. I've managed to fix some items but some are still very bewildering. I'll start with the error: ERROR:

[ossec-list] ERROR: Invalid ID for the source ip: 'x.x.x.x'

2015-04-07 Thread Sinisha Erceg
Thanks Eero for your quick reply. I am aware of this and we only use either a direct IP address or a subnet range. Would this still occur using a subnet? We explicitly do not use ANY. I may have tested this on a box a while back but it's nothing that is currently being used for any of our

Re: [ossec-list] ERROR: Invalid ID for the source ip: 'x.x.x.x'

2015-04-07 Thread Eero Volotinen
2015-04-07 21:55 GMT+03:00 Sinisha Erceg ser...@windmobile.ca: Hello, I apologize in advance for lack of understanding and I’ve attempted to look through the forums but I have inherited OSSEC from a predecessor and I have limited *nix experience. I’ve managed to fix some items but some

Re: [ossec-list] ERROR: Invalid ID for the source ip: 'x.x.x.x'

2015-04-07 Thread Eero Volotinen
Is source address incorrect? Ipsec connections, firewalls with nat rules can cause this kind of issues. Try dumping ossec traffic from manager and check that ip source is correct? Eero 7.4.2015 11.36 ip. Sinisha Erceg ser...@windmobile.ca kirjoitti: Thanks Eero for your quick reply. I am