Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had to add another IP address to our server (eth0:1 192.168.0.100) and all of the sudden ossec client stopped working.

On the client side I'm seeing this: 2014/02/19 02:31:28 ossec-agentd: INFO: Trying to connect to server (server_ip:1514). 2014/02/19 02:31:28 ossec-agentd: INFO: Using IPv4 for: server_ip. 2014/02/19 02:31:49 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'server_ip'.

How can this be fixed? Most likely I have to specify the source ip or source interface on the client side but I can't figure out where.

share|improve this question
    
What is the output of ip route on your client? –  sciurus Feb 24 at 20:25
    
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.10 10.0.0.0/8 dev eth0 proto kernel scope link src 10.0.0.100 –  MB. Feb 27 at 3:37
    
Adding a net mask for 10.0.0.100 fixed it. If you can add an answer I'll accept it. –  MB. Feb 27 at 3:41
    
I added the answer. –  sciurus Mar 3 at 16:27

1 Answer 1

up vote 1 down vote accepted

It may be that your network configuration is incorrect. Check ip route to make sure you still have a sane route to the server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.