[ossec-list] Re: Agentd waiting for server reply

["Nicolas Nicolas" <thedarksideofme@xxxxxxxxx>]

Hi mate!

tcpdump in the agent??? you should see packages from both sides...

if you dont have firewalls, theres must be some trouble with the key...

hope it helps

cheers!

On 2/23/07, Chris Tankersley <chris.tankersley@xxxxxxxxxxxxxxxxx> wrote:

Hello everyone.

We recently updated to 1.0 as well as installed the WUI, but had some
issues (permissions were set up incorrectly and ossec imploded) that
caused all of our agents to stop responding. I reinstalled the OSSEC
server by telling it to do an upgrade and then restarted all of the
agents, and all have come back up except for one named Fileserver. When
I check /var/ossec/logs/ossec.log I see this:

2007/02/23 16:30:28 ossec-agentd(4101): Waiting for server reply (not
started).

I tried re-importing the key as well as doing a reinstall on this
machine. If I do a nestat, I see that it makes a connection to the server:

udp        0      0 192.168.1.10:48296
192.168.1.42:1514            ESTABLISHED 9172/ossec-agentd


There are no firewalls  between the two machines, and any time that
we've done upgrades we've always done the upgrade option instead of
blowing out ossec and starting from scratch.

Any help would be appreciated.

Chris

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.