Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an two ec2 instances. In one I have installed ossec server and in other I have installed ossec agent.

Here are my server config INBOUND (security group/firewall) :

port:514   source:0.0.0.0/0
port:1514   source:0.0.0.0/0

But it seems to be not working. In my agent log file I keep on getting:

2012/08/28 06:52:52 ossec-agentd: INFO: Using IPv4 for: x.x.x.x.x.x .
2012/08/28 06:53:13 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'x.x.x.x.x'.

Edit:

Running sudo netstat --inet -nlp | grep ossec. I'm getting:

udp        0      0 0.0.0.0:1514            0.0.0.0:*                           26027/ossec-remoted

Where I'm making the mistake?

share|improve this question
    
On the server, give us the output of netstat --inet -nlp | grep ossec? –  quanta Aug 28 '12 at 7:00
    
@quanta: I have edited my question.. –  batman Aug 28 '12 at 7:04
    
What does ossec.log on the server say? Are you sure the client's IP is correct in agent_control -l list? –  quanta Aug 28 '12 at 7:14
    
It says ossec-remoted(1403): ERROR: Incorrectly formated message from 'my client ip'. –  batman Aug 28 '12 at 7:17
add comment

1 Answer

up vote 2 down vote accepted

It says ossec-remoted(1403): ERROR: Incorrectly formated message from 'my client ip'.

It means that you have imported the wrong authentication keys (maybe from a different agent) or the IP address you configured the agent is different from what the server is seeing. Removing and re-adding the key (make sure the IP is correct) and try again.

share|improve this answer
    
Now on the server logs I can see mess like ossec-logcollector: INFO: Started (pid: 30441). But still in client I'm getting the same WARN: Waiting for server reply (not started). Tried: 'x.x.x.x.x'. Error! –  batman Aug 28 '12 at 7:41
    
What could be the issue? –  batman Aug 28 '12 at 8:11
    
Am I need to open any ports in client side?? –  batman Aug 28 '12 at 8:16
    
No. Which firewall are you using? Make sure that you have opened those up for UDP and allowed outbound traffic. –  quanta Aug 28 '12 at 8:27
    
Can you be clear? Outbound traffic in server side or client side? What port I need to open? I'm very new to OSSEC, kindly help me. –  batman Aug 28 '12 at 8:30
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.