[ossec-list] Re: error 1403: incorrectly formated message

["Wing, Robert" <Robert.Wing@xxxxxxxxxx>]

Looks like removing then read the key work I am no longer seeing the
format error just nothing being alerted to at the moment

Regards
 
Robert Wing
IT Security Analyst
Clarks International
40 High Street,
Street,
Somerset BA16 0YA
Tel: 01458 843088
mailto:robert.wing@xxxxxxxxxx
 
-----Original Message-----
From: ossec-list@xxxxxxxxxxxxxxxx [mailto:ossec-list@xxxxxxxxxxxxxxxx]
On Behalf Of Daniel Cid
Sent: 07 August 2006 14:13
To: ossec-list@xxxxxxxxxxxxxxxx
Cc: robert.wing@xxxxxxxxx
Subject: [ossec-list] Re: error 1403: incorrectly formated message


Hi Robert,

We just have a similar problem reported to the list. This is the answer
i gave:

"
I had this problem before when I misconfigured the keys for the agents.
Can you make sure that the agent, really has the right key on it (
that matches his ip address)?

*do an ifconfig on the agent and look at /var/ossec/etc/client.keys to
make
sure that the IP address is correct in there.

If that does not fix the problem, can you show us the following files:

*for both server and agents:
/etc/ossec-init.conf
/var/ossec/etc/ossec.conf
/var/ossec/logs/ossec.log
/var/ossec/etc/client.keys (change the secret key before posting)
ifconfig -a
iptables -vL
"

Basically, if the ip address that the ossec-server is receiving the
messages
does not match what he has in the client.keys file, you will get this
error...

hope it helps,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 8/7/06, robert.wing@xxxxxxxxx <robert.wing@xxxxxxxxx> wrote:
>
> I am experimenting with ossec 0.9 witht he aim of running a large
> number of clients.
> i have encountered the following error
>
> ossec-remoted(1403): Incorrectly formated message from client IP
>
> anyone have any ideas
>
> uninstalling and reinstalling will not be an option if this happens
> after a roll out
>
>


 




Please check that this email is addressed to you. If not, you should delete it immediately as its contents may be confidential and its disclosure, copying or distribution unlawful.

C. & J. Clark International Limited takes steps to prevent the transmission of electronic viruses but responsibility for screening incoming messages and the risk of such transmission lies with the recipient.

This message has been scanned for viruses by BlackSpider MailControl - www.blackspider.com