OSSec not working on server with multiple IPS

Question

I had to add another IP address to our server (eth0:1 192.168.0.100) and all of the sudden ossec client stopped working.

On the client side I'm seeing this: 2014/02/19 02:31:28 ossec-agentd: INFO: Trying to connect to server (server_ip:1514). 2014/02/19 02:31:28 ossec-agentd: INFO: Using IPv4 for: server_ip. 2014/02/19 02:31:49 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: 'server_ip'.

How can this be fixed? Most likely I have to specify the source ip or source interface on the client side but I can't figure out where.

10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.10 10.0.0.0/8 dev eth0 proto kernel scope link src 10.0.0.100 — MB., Feb 27 '14 at 03:37
Adding a net mask for 10.0.0.100 fixed it. If you can add an answer I'll accept it. — MB., Feb 27 '14 at 03:41

score 1 · Accepted Answer · answered Feb 27 '14 at 03:55

1

It may be that your network configuration is incorrect. Check ip route to make sure you still have a sane route to the server.

answered Feb 27 '14 at 03:55

sciurus

12,493
2
30
49

OSSec not working on server with multiple IPS

1 Answers1