• Support
  • Forums
  • Blogs

Can ossec agent connect ossim sensor?

ninanina

New Life Form
I have installed  an ossim server and   an ossim sensor to test ossim and tested few function since setup.And  I  need to collect log from a lot of other normal server.  I  set up a ossec agent on a normal linux server follow the tutorial 
It realy work well.the data was showed in web interface.

BUT when I  changed the senor of  the linux  server into ossim sensor, generated a key under the sensor,paste the key into the linux server's ossec agent,the status of the agent changed into disconneted...and no more data to web interface showed...

here are some configuration .


1516609913(1)

the follow picture is the list of ossim sensor's agent in the web interface.
1516610185(1)

and I  also checked the processes of ossim sensor, it shows like this

微信截图_20180122164021



微信截图_20180122164105

and  i also use tcpdump to capture the packages on port 1514 

1516610566(1)

BUT the log of the linux server is always warn like this...

warn


the status never changed into active....the data also nerver showed in the web interface search...

I am doubt the ossec sensor...can the ossec agent connect the ossim senor,or only the ossim server is allowed?

Share post:

Comments

Sign In or Register to comment.