[ossec-list] Re: ossec-agentd: error compressing string

[David Vasil <dmvasil@xxxxxxxx>]

oahmet wrote:
> 
> Hi agian David,
> 
> Debian-amd64 was just a blind guess :)

Not a problem, I should have been more specific in my initial question.

> Let me ask another question:
> Did you use the same rpm for your i686 and amd64 machines?
> If so, please create rpms on both your server(i686) and
> on your client (amd64).

I did not use the same rpm.  I compiled and installed the server using
the install script provided with the OSSEC source.  The only reason I
installed the amd64 system with the RPM for x86_64 was to test various
deployment methods (as some of our servers are not installed with
compilers, etc.).

> I think this is a little endian/big endian issue. (AFAIK x86_64 is a
> big endian architecture).

I wrote a quick program and verified both systems are little endian.

I brought another agent up (i686 this time) and this time there is
traffic between the hosts.  The client logs show no errors (besides not
being able to open logs which dont exist at the moment).  The server
side logs one of these for every udp packet it sees:

2006/08/08 13:40:39 ossec-remoted(2202): Error uncompressing string.
2006/08/08 13:40:45 ossec-remoted(2202): Error uncompressing string.
2006/08/08 13:41:29 ossec-remoted(2202): Error uncompressing string.

At least the client and server are talking to each other now between
these two archs, but the server isnt accepting the input.  I verified
both client and server have matching keys in their client.xml files.

What situations would cause this type of behavior?  The x86_64 client
has trouble compressing the strings, and the i686 server has trouble
uncompressing strings.

-- 
-dave