[ossec-list] Re: Agentd waiting for server reply

[Chris Tankersley <chris.tankersley@xxxxxxxxxxxxxxxxx>]

I checked TCP dump and it was sending the requests all the way to the 
server, so I deleted and readded the agent and it popped back online. 
Thanks!

As for the permissions, it wasn't the script. The guy who tried to 
install the WUI didn't set up the groups properly and tried manually 
chmoding the queue file to 777 in the theory that the WUI would read it. 
OSSEC didn't like that, and refused to run after that.

Thankfully, the only issues I've ever had with OSSEC have been due to 
our own errors, not OSSEC itself. Thanks for the great work on this program.

Daniel Cid wrote:
> Hi Chris,
>
> I second what Nicolas said... It must be something in the keys. 
> Remember that
> ossec keep track of all messages sent, so if you reinstall ossec 
> (without doing
> an upgrade), you will lose the internal counter and the server and
> agent will not
> be in sync anymore. Try the to remove this agent from the server and 
> add it
> back again. After that, restart the server and re-import this new key 
> in the
> agent... It should fix the problem.
>
> Btw, how did you get these permissions errors? The installation is 
> supposed
> to handle all that for you..
>
> hope it helps.
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
> On 2/23/07, Chris Tankersley <chris.tankersley@xxxxxxxxxxxxxxxxx> wrote:
> > Hello everyone.
> >
> > We recently updated to 1.0 as well as installed the WUI, but had some
> > issues (permissions were set up incorrectly and ossec imploded) that
> > caused all of our agents to stop responding. I reinstalled the OSSEC
> > server by telling it to do an upgrade and then restarted all of the
> > agents, and all have come back up except for one named Fileserver. When
> > I check /var/ossec/logs/ossec.log I see this:
> >
> > 2007/02/23 16:30:28 ossec-agentd(4101): Waiting for server reply (not
> > started).
> >
> > I tried re-importing the key as well as doing a reinstall on this
> > machine. If I do a nestat, I see that it makes a connection to the 
> > server:
> >
> > udp        0      0 192.168.1.10:48296
> > 192.168.1.42:1514            ESTABLISHED 9172/ossec-agentd
> >
> >
> > There are no firewalls  between the two machines, and any time that
> > we've done upgrades we've always done the upgrade option instead of
> > blowing out ossec and starting from scratch.
> >
> > Any help would be appreciated.
> >
> > Chris
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.