[ossec-list] Re: error 1403: incorrectly formated message

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Robert,

We just have a similar problem reported to the list. This is the answer i gave:

"
I had this problem before when I misconfigured the keys for the agents.
Can you make sure that the agent, really has the right key on it (
that matches his ip address)?

*do an ifconfig on the agent and look at /var/ossec/etc/client.keys to make
sure that the IP address is correct in there.

If that does not fix the problem, can you show us the following files:

*for both server and agents:
/etc/ossec-init.conf
/var/ossec/etc/ossec.conf
/var/ossec/logs/ossec.log
/var/ossec/etc/client.keys (change the secret key before posting)
ifconfig -a
iptables -vL
"

Basically, if the ip address that the ossec-server is receiving the messages
does not match what he has in the client.keys file, you will get this
error...

hope it helps,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 8/7/06, robert.wing@xxxxxxxxx <robert.wing@xxxxxxxxx> wrote:
> I am experimenting with ossec 0.9 witht he aim of running a large
> number of clients.
> i have encountered the following error
>
> ossec-remoted(1403): Incorrectly formated message from client IP
>
> anyone have any ideas
>
> uninstalling and reinstalling will not be an option if this happens
> after a roll out