[ossec-list] Re: Waiting for server reply (not started)

[Jeremy Melanson <jmelanson@xxxxxxxxxxx>]

You probably need to reload the OSSEC Server. After you add the host
keys, OSSEC needs to reread them. I don't recall which daemon (I suppose
I should look that up one of these days ;-). I usually just issue
'ossec-control stop' and 'ossec-control start'.

-----
Jeremy


On Thu, 2007-04-19 at 13:13 -0400, Tim Boyer wrote:
> I'm just getting started, and I'm running into a communications problem
> somewhere.  I'm trying to set up an agent/server between two RHEL4 systems.
> 
> 
> I know it's listening:
> 
> [root@saratoga logs]# netstat -tupln|grep 1514
> udp        0      0 0.0.0.0:1514                0.0.0.0:*
> 8449/ossec-remoted
> 
> It's not a firewall issue, because I can do this on the agent machine:
> 
> [root@tolstoy var]# nc -u 192.168.0.201 1514
> testing 1 2 3
> 
> and I get this on the server machine:
> 
> [root@saratoga logs]# nc -ul -p 1514
> testing 1 2 3
> 
> The agent logs say they can connect to each other:
> 
> 2007/04/19 12:42:39 ossec-agentd: Started (pid: 22004).
> 2007/04/19 12:42:39 ossec-agentd: Connecting to server (192.168.0.201:1514).
> 
> but they can't talk to each other:
> 
> 2007/04/19 12:42:54 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:43:10 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:43:41 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:44:27 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:45:28 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:46:44 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:48:15 ossec-agentd(4101): Waiting for server reply (not
> started).
> 
> I've deleted/reinstalled the agent from the server, and restarted the
> server.  No luck. I'm stumped,  and I'm sure it's something simple I'm
> missing.  A nudge in the right direction would be greatly appreciated.
>