OSSEC is not running

ubuntu amazon-ec2 ubuntu-12.04 ossec

It says ossec-remoted(1403): ERROR: Incorrectly formated message from 'my client ip'.

It means that you have imported the wrong authentication keys (maybe from a different agent) or the IP address you configured the agent is different from what the server is seeing. Removing and re-adding the key (make sure the IP is correct) and try again.


In my case, this error was caused by an unsynced queue between server and agent, after server migration.

Queues "/var/ossec/queue/rids" must be copied from an old server. Also, see Wazuh's recommendations for migrating from OSSEC.

You can clear Directory "./rid" on windows agent as workaround.

Related

Given an existing unencrypted AWS EFS volume, can somebody give me a path for encrypting it without data loss?
Getting no servers could be reached when using host, nslookup and dig
Wireguard connection fails when DNS isn't working
"or die()" in Python
Why does wget only download the index.html for some websites?
Render partial :collection => @array specify variable name
How can I preserve new lines in an AngularJS partial?
RabbitMQ by Example: Multiple Threads, Channels and Queues
tap gesture recognizer - which object was tapped?
How do I add a section title in UICollectionView?
In Xcode how do I create a new workspace and add 1 project to it so that I can see the project and its files?
Server.Mappath in C# classlibrary