Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had to add another IP address to our server (eth0:1 and all of the sudden ossec client stopped working.

On the client side I'm seeing this: 2014/02/19 02:31:28 ossec-agentd: INFO: Trying to connect to server (server_ip:1514). 2014/02/19 02:31:28 ossec-agentd: INFO: Using IPv4 for: server_ip. 2014/02/19 02:31:49 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'server_ip'.

How can this be fixed? Most likely I have to specify the source ip or source interface on the client side but I can't figure out where.

share|improve this question
What is the output of ip route on your client? – sciurus Feb 24 '14 at 20:25 dev eth0 proto kernel scope link src dev eth0 proto kernel scope link src – MB. Feb 27 '14 at 3:37
Adding a net mask for fixed it. If you can add an answer I'll accept it. – MB. Feb 27 '14 at 3:41
I added the answer. – sciurus Mar 3 '14 at 16:27
up vote 1 down vote accepted

It may be that your network configuration is incorrect. Check ip route to make sure you still have a sane route to the server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.