On Mon, Aug 20, 2012 at 7:38 AM, bw <bw.mail.li...@gmail.com> wrote: > > Deleted everything (rm -rf /var/ossec /etc/ossec-init.conf > /etc/init.d/ossec), got 7987046f6bb1 from JBCheng's repo, that should be > latest at this time, installed it on server with only one agent, the least > busy one, no virtualization involved, first restart of the server I got the > warning again.
What network devices are between the agent and the server? If the server is still multi-homed set the listen ip to the one the agent will connect to. For reference, so I don't have to dig through this thread again, what OS/distro/version/architecture is the agent? Is that also running the latest source?
