[ossec-list] Re: Waiting for server reply (not started)

["Pankaj P. Pawar" <Pankajpa@xxxxxxxxxx>]

***********************
Your mail has been scanned by InterScan.
***********-***********


Hi,

I tried to issue the same commands on my client and the server.
But I am getting the following message on the server.

[root@ossec ~]# nc -ul -p 1514
Can't grab 0.0.0.0:1514 with bind

Any idea why this is not happening?

Thanks,
Pankaj P.



-----Original Message-----
From: ossec-list@xxxxxxxxxxxxxxxx [mailto:ossec-list@xxxxxxxxxxxxxxxx]
On Behalf Of Jeremy Melanson
Sent: Thursday, April 19, 2007 11:29 PM
To: ossec-list@xxxxxxxxxxxxxxxx
Subject: [ossec-list] Re: Waiting for server reply (not started)

***********************
Your mail has been scanned by InterScan.
***********-***********



You probably need to reload the OSSEC Server. After you add the host
keys, OSSEC needs to reread them. I don't recall which daemon (I suppose
I should look that up one of these days ;-). I usually just issue
'ossec-control stop' and 'ossec-control start'.

-----
Jeremy


On Thu, 2007-04-19 at 13:13 -0400, Tim Boyer wrote:
> I'm just getting started, and I'm running into a communications
problem
> somewhere.  I'm trying to set up an agent/server between two RHEL4
systems.
> 
> 
> I know it's listening:
> 
> [root@saratoga logs]# netstat -tupln|grep 1514
> udp        0      0 0.0.0.0:1514                0.0.0.0:*
> 8449/ossec-remoted
> 
> It's not a firewall issue, because I can do this on the agent machine:
> 
> [root@tolstoy var]# nc -u 192.168.0.201 1514
> testing 1 2 3
> 
> and I get this on the server machine:
> 
> [root@saratoga logs]# nc -ul -p 1514
> testing 1 2 3
> 
> The agent logs say they can connect to each other:
> 
> 2007/04/19 12:42:39 ossec-agentd: Started (pid: 22004).
> 2007/04/19 12:42:39 ossec-agentd: Connecting to server
(192.168.0.201:1514).
> 
> but they can't talk to each other:
> 
> 2007/04/19 12:42:54 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:43:10 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:43:41 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:44:27 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:45:28 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:46:44 ossec-agentd(4101): Waiting for server reply (not
> started).
> 2007/04/19 12:48:15 ossec-agentd(4101): Waiting for server reply (not
> started).
> 
> I've deleted/reinstalled the agent from the server, and restarted the
> server.  No luck. I'm stumped,  and I'm sure it's something simple I'm
> missing.  A nudge in the right direction would be greatly appreciated.
> 




***********************************************************************************
This message is for the named addressees' use only. It may contain NSDL

confidential, proprietary or legally privileged information. If you receive 

this message in error, please immediately delete it. You must not, directly

or indirectly, use, disclose, distribute, print, or copy any part of this message

if you are not the intended recipient.Unless otherwise stated, any commercial

information given in this message does not constitute an offer to deal on 

any terms quoted.  Any reference to the terms of executed transactions 

should be treated as preliminary only and subject to our formal written 

confirmation.
***********************************************************************************