hi thank you reply it.
yes,my ossec server is ossec 2.7 and my ossec-agent is ossec 2.6,but my other agent also is ossec 2.6 and work normal.i down konw why this. thanks&Best Regards From: Kat Date: 2013-01-31 03:18 To: ossec-list Subject: Re: [ossec-list] splunk+ossec ossec-agent Disconnected? Has nothing to do with splunk or not -- and my guess is this is not ossec 2.7? You can check if you have a tool like netcat (default installed on Linux) by doing "nc -u server-address 1514" then type a few lines to see if on the server you are seeing errors in the log file (incorrectly formatted" or "not allowed" messages. However, most of the connection related problems were resolved in 2.7. make sure you are on the newest. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.