If this is a new agent, did you restart ossec on the server? If not new, did you delete the corresponding id in /var/ossec/queue/rids directory? What does tcpdump or tshark show for 1514 traffic between the server and the agent?
On Wednesday, May 15, 2013 6:46:40 AM UTC-4, Kyle Vorster wrote: > > Hey there, > > I'm having issues getting a agent connected to the server, I've followed > all the docs in resolving this issue but just cant get it to work. Error I > get > > 2013/05/15 12:43:50 ossec-logcollector: INFO: Monitoring full output of > command(360): netstat -tan |grep LISTEN |grep -v 127.0.0.1 | sort > 2013/05/15 12:43:50 ossec-logcollector: INFO: Monitoring full output of > command(360): last -n 5 > 2013/05/15 12:43:50 ossec-logcollector: INFO: Started (pid: 20948). > 2013/05/15 12:43:52 ossec-logcollector: WARN: Process locked. Waiting for > permission... > 2013/05/15 12:44:05 ossec-agentd(4101): WARN: Waiting for server reply > (not started). Tried: 'server-ip'. > 2013/05/15 12:44:07 ossec-agentd: INFO: Trying to connect to server > (server-ip:1514). > 2013/05/15 12:44:07 ossec-agentd: INFO: Using IPv4 for: server-ip . > 2013/05/15 12:44:28 ossec-agentd(4101): WARN: Waiting for server reply > (not started). Tried: 'server-ip'. > > Followed the advice at > http://www.ossec.net/doc/faq/unexpected.html#how-do-i-troubleshoot-ossecbut > still no luck, anyone have an idea of what I can do to troubleshoot or > resolve this issue. > > - Kyle > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
