Another agent disconnect issue

Support/Development for OSSEC
mhhall3
New Forum User
New Forum User
Posts: 2
Joined: Tue Dec 14, 2021 1:45 pm

Another agent disconnect issue

Unread post by mhhall3 »

I am having some difficulty getting some clients to connect to my Ossec server. Have confirmed that correct IP address is in place on client (and removed from log below). Server is accepting connections from other clients. I have tried to remove the /var/ossec/queue/ossec/.wait file to clear what appears to be errors below for Process being locked. I've tried enabling debugging info (=1) in etc/internal_options.conf .

Was hoping for someone to recognize issue, or suggest further ways to obtain info on issue.
Thanks, Mike



Code: Select all

2021/12/14 12:52:16 ossec-logcollector: INFO: Started (pid: 1199315).
2021/12/14 12:52:22 ossec-logcollector: WARN: Process locked. Waiting for permission...
2021/12/14 12:52:31 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'ossec-serverIP'.
2021/12/14 12:52:33 ossec-agentd: INFO: Trying to connect to server ossec-serverIP, port 1514.
2021/12/14 12:52:33 INFO: Connected to ossec-serverIP at address ossec-serverIP, port 1514
2021/12/14 12:52:33 ossec-agentd [dns]: DEBUG: n == 0
2021/12/14 12:52:33 ossec-agentd: WARN: n == 0
2021/12/14 12:52:33 ossec-agentd: DEBUG: agt->sock: 15
2021/12/14 12:52:54 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'ossec-serverIP'.
2021/12/14 12:53:14 ossec-agentd: INFO: Trying to connect to server ossec-serverIP, port 1514.
2021/12/14 12:53:14 INFO: Connected to ossec-serverIP at address ossec-serverIP, port 1514
2021/12/14 12:53:14 ossec-agentd [dns]: DEBUG: n == 0
2021/12/14 12:53:14 ossec-agentd: WARN: n == 0
2021/12/14 12:53:14 ossec-agentd: DEBUG: agt->sock: 18
2021/12/14 12:53:16 ossec-syscheckd: INFO: Starting syscheck scan (forwarding database).
2021/12/14 12:53:16 ossec-syscheckd: WARN: Process locked. Waiting for permission...
2021/12/14 12:53:35 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'ossec-serverIP'.
User avatar
cponton
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 61
Joined: Fri Oct 09, 2020 9:41 am

Re: Another agent disconnect issue

Unread post by cponton »

Please verify that the auth key on the client matches the corresponding agent ID on the HUB

https://www.ossec.net/docs/manual/agent ... sec-server
mhhall3
New Forum User
New Forum User
Posts: 2
Joined: Tue Dec 14, 2021 1:45 pm

Re: Another agent disconnect issue

Unread post by mhhall3 »

I have checked to confirm that the client.key is installed and matches on both server and client.
I'm seeing this on a small percentage of my systems (>5%).
Post Reply