1

I had to add another IP address to our server (eth0:1 192.168.0.100) and all of the sudden ossec client stopped working.

On the client side I'm seeing this: 2014/02/19 02:31:28 ossec-agentd: INFO: Trying to connect to server (server_ip:1514). 2014/02/19 02:31:28 ossec-agentd: INFO: Using IPv4 for: server_ip. 2014/02/19 02:31:49 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'server_ip'.

How can this be fixed? Most likely I have to specify the source ip or source interface on the client side but I can't figure out where.

Improve this question
4
  • What is the output of ip route on your client?
    – sciurus
    Commented Feb 24, 2014 at 20:25
  • 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.10 10.0.0.0/8 dev eth0 proto kernel scope link src 10.0.0.100
    – MB.
    Commented Feb 27, 2014 at 3:37
  • Adding a net mask for 10.0.0.100 fixed it. If you can add an answer I'll accept it.
    – MB.
    Commented Feb 27, 2014 at 3:41
  • I added the answer.
    – sciurus
    Commented Mar 3, 2014 at 16:27

1 Answer 1

Reset to default
1

It may be that your network configuration is incorrect. Check ip route to make sure you still have a sane route to the server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .