Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just installed OSSec accordingly as the server. When it asked for my email I put in my GMail address and for the SMTP I was not sure so I just set it as localhost first. Then it runs a number of commands accordingly. Finally it states this:

In order to connect agent and server, you need to add each agent to the server.
   Run the 'manage_agents' to add or remove them:


Another thing I did this /var/ossec/bin/ossec-control start

Starting OSSEC HIDS v2.6 (by Trend Micro Inc.)...
OSSEC analysisd: Testing rules failed. Configuration error. Exiting.
Started ossec-maild...
Started ossec-execd...
Started ossec-analysisd...
Started ossec-logcollector...
Started ossec-remoted...
Started ossec-syscheckd...

Part of config file.


Started ossec-monitord...

So what error is it telling me about the configuration?

share|improve this question
up vote 2 down vote accepted

You made a mistake in your configuration, probably the way you entered your smtp or email address. Check your config here /var/ossec/etc/ossec.conf (add it to your question). It should look somewhat like this:


The first rule is to tell you you can add agents (other servers running ossec reporting to this central server). This means you probably installed OSSEC was installed as server. If this is your only machine you are better off installing as standalone. I posted a guide on my blog for OSSEC which explains some of the basics.

share|improve this answer
I have addded my quesstion with part of the ossec.conf file. Yes when it as me to to install as server manager or agent I installed as server so what is wrong here? How can I undo this now? – new14 Dec 30 '12 at 10:49
I did this ln s /var/ossec/bin/osseclogtest /var/ossec/ossec-logtest and the error is gone. So how to verify is everything is working I also did this /var/ossec/bin/ossec-contro enable agentless is this correct? – new14 Dec 31 '12 at 4:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.