Geez who would have known. I've been beating my head against the wall
trying to figure it out, worked perfectly after I removed the agent from
the server and added FQDN and CIDR to OSSEC server. Thanks for the answer!
Just wondering, was your agent on a Linux or Windows machine? In my case
it was a Windows machine.
--
Michael D. Wood
ITSecurityPros.org
www.itsecuritypros.org
On Tuesday, March 6, 2012 1:59:07 PM UTC-5, ScottyMace wrote:
I've seen this issue raised before, but never answered. There is a
firewall between the agent and server, but proper access lists are in
place. I used netcat to verify communication is working fine both
ways, for udp port 1514, and various random high ports from the server
to the client, just in case. Agent is 2.6, server is 2.5.1
(AlienVault server)
The problem even after the above:
From agent log, this message repeated:
2012/03/06 11:02:23 ossec-agentd: INFO: Using IPv4 for: 10.10.xxx.51 .
2012/03/06 11:02:24 ossec-agentd(1214): WARN: Problem receiving
message from 10.10.xxx.51.
2012/03/06 11:02:33 ossec-agentd(1214): WARN: Problem receiving
message from 10.10.xxx.51.
2012/03/06 11:02:38 ossec-agentd(1214): WARN: Problem receiving
message from 10.10.xxx.51.
2012/03/06 11:02:44 ossec-agentd(1214): WARN: Problem receiving
message from 10.10.xxx.51.
2012/03/06 11:02:44 ossec-agentd(4101): WARN: Waiting for server reply
(not started). Tried: '10.10.xxx.51'.
Server side, list agents says the client in question has never connected.
Solution:
I did three things to get this to work:
Remove said agent from the sever
Recreate agent on server using FQDN as the host name, (originally
using short hostname) and
IP address in full CIDR format: xxx.xxx.xxx.xxx/32 (originally without
/32)
Once that was done, re-import the key into the agent box, and restart
server and agent processes. Worked fine after that.
Scott
