Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an two ec2 instances. In one I have installed ossec server and in other I have installed ossec agent.

Here are my server config INBOUND (security group/firewall) :

port:514   source:
port:1514   source:

But it seems to be not working. In my agent log file I keep on getting:

2012/08/28 06:52:52 ossec-agentd: INFO: Using IPv4 for: x.x.x.x.x.x .
2012/08/28 06:53:13 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'x.x.x.x.x'.


Running sudo netstat --inet -nlp | grep ossec. I'm getting:

udp        0      0  *                           26027/ossec-remoted

Where I'm making the mistake?

share|improve this question
On the server, give us the output of netstat --inet -nlp | grep ossec? – quanta Aug 28 '12 at 7:00
@quanta: I have edited my question.. – batman Aug 28 '12 at 7:04
What does ossec.log on the server say? Are you sure the client's IP is correct in agent_control -l list? – quanta Aug 28 '12 at 7:14
It says ossec-remoted(1403): ERROR: Incorrectly formated message from 'my client ip'. – batman Aug 28 '12 at 7:17
up vote 2 down vote accepted

It says ossec-remoted(1403): ERROR: Incorrectly formated message from 'my client ip'.

It means that you have imported the wrong authentication keys (maybe from a different agent) or the IP address you configured the agent is different from what the server is seeing. Removing and re-adding the key (make sure the IP is correct) and try again.

share|improve this answer
Now on the server logs I can see mess like ossec-logcollector: INFO: Started (pid: 30441). But still in client I'm getting the same WARN: Waiting for server reply (not started). Tried: 'x.x.x.x.x'. Error! – batman Aug 28 '12 at 7:41
What could be the issue? – batman Aug 28 '12 at 8:11
Am I need to open any ports in client side?? – batman Aug 28 '12 at 8:16
No. Which firewall are you using? Make sure that you have opened those up for UDP and allowed outbound traffic. – quanta Aug 28 '12 at 8:27
Can you be clear? Outbound traffic in server side or client side? What port I need to open? I'm very new to OSSEC, kindly help me. – batman Aug 28 '12 at 8:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.