Hi, probably you need to reset the counters:
Stop manager and the agent: /var/ossec/bin/ossec-control stop *agent* - cd /var/ossec/queue/rids - remove all the files *manager* - cd /var/ossec/queue/rids - Remove *the file of the agent* (the filename is the agent ID) Start manager and the agent: /var/ossec/bin/ossec-control start Let me know if it works. Regards. On Tuesday, September 13, 2016 at 12:52:57 AM UTC+2, cher...@usa.g4s.com wrote: > > I tried to reinstall the agent manually and push it from the web GUI. I > made sure the OSSEC agent manager ip was pointing to the right server. > I would like to not jailbreak the server if possible. > > > I looked at the logs and this seems like a regular issue. > > 2016/09/12 16:59:45 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: 'ip'. > > 2016/09/12 17:01:53 ossec-agent: INFO: Trying to connect to server > (ip:1514). > > 2016/09/12 17:01:53 ossec-agent: INFO: Using IPv4 for: ip. > > 2016/09/12 17:02:14 ossec-agent(4101): WARN: Waiting for server reply (not > started). Tried: 'ip'. > > 2016/09/12 17:03:11 ossec-agent: Using notify time: 120 and max time to > reconnect: 240 > > 2016/09/12 17:03:11 ossec-execd: INFO: Started (pid: ip). > > 2016/09/12 17:03:11 ossec-agent(1410): INFO: Reading authentication keys > file. > > 2016/09/12 17:03:11 ossec-agent: INFO: No previous counter available for > 'Host-ip'. > > 2016/09/12 17:03:11 ossec-agent: INFO: Assigning counter for agent > Host-ip: '0:0'. > > 2016/09/12 17:03:11 ossec-agent: INFO: Assigning sender counter: 0:84 > > 2016/09/12 17:03:11 ossec-agent: INFO: Trying to connect to server > (ip:1514). > > > > > > This company is part of the G4S group of companies. This communication > contains information which may be confidential, personal and/or privileged. > It is for the exclusive use of the intended recipient(s). If you are not > the intended recipient(s), please note that any distribution, forwarding, > copying or use of this communication or the information in it is strictly > prohibited. Any personal views expressed in this e-mail are those of the > individual sender and the Company does not endorse or accept responsibility > for them. Prior to taking any action based upon this e-mail message, you > should seek appropriate confirmation of its authenticity. This message has > been checked for viruses on behalf of the Company. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
