[ossec-list] Re: Agentd waiting for server reply

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Chris,

I second what Nicolas said... It must be something in the keys. Remember that
ossec keep track of all messages sent, so if you reinstall ossec (without doing
an upgrade), you will lose the internal counter and the server and
agent will not
be in sync anymore. Try the to remove this agent from the server and add it
back again. After that, restart the server and re-import this new key in the
agent... It should fix the problem.

Btw, how did you get these permissions errors? The installation is supposed
to handle all that for you..

hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 2/23/07, Chris Tankersley <chris.tankersley@xxxxxxxxxxxxxxxxx> wrote:
> Hello everyone.
>
> We recently updated to 1.0 as well as installed the WUI, but had some
> issues (permissions were set up incorrectly and ossec imploded) that
> caused all of our agents to stop responding. I reinstalled the OSSEC
> server by telling it to do an upgrade and then restarted all of the
> agents, and all have come back up except for one named Fileserver. When
> I check /var/ossec/logs/ossec.log I see this:
>
> 2007/02/23 16:30:28 ossec-agentd(4101): Waiting for server reply (not
> started).
>
> I tried re-importing the key as well as doing a reinstall on this
> machine. If I do a nestat, I see that it makes a connection to the server:
>
> udp        0      0 192.168.1.10:48296
> 192.168.1.42:1514            ESTABLISHED 9172/ossec-agentd
>
>
> There are no firewalls  between the two machines, and any time that
> we've done upgrades we've always done the upgrade option instead of
> blowing out ossec and starting from scratch.
>
> Any help would be appreciated.
>
> Chris
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.