agent not reflecting in server

[Merwin samuel]

Dear sir/Mam

                     I have did the steps correctly from a ubuntu server and added a windows agent Net start Wazuh, it started perfectly but the windows agent is not reflecting in the server even after a restart.

                     Please educate me regarding this.

Thanks

[Md. Nazmur Sakib]

Hello

Check the status of the agent.

Open the Wazuh agent app and check if the agent status is running.

Also, make sure you have the correct Manager's address in the  Manager IP section.

If not, add the correct Manager IP and click on Save.

Next, click on Manage and restart the agent.

Wait for a few seconds if you still do not see your agent on your Wazuh Dashboard.

Check the connection.

On Windows, open a PowerShell terminal and run the following command:

# (new-object Net.Sockets.TcpClient).Connect("<WAZUH_MANAGER_IP_ADDRESS>", 1514)

# (new-object Net.Sockets.TcpClient).Connect("<WAZUH_MANAGER_IP_ADDRESS>", 1515)

# (new-object Net.Sockets.TcpClient).Connect("<WAZUH_MANAGER_IP_ADDRESS>", 55000)

If there is connectivity, there is no output. Otherwise, an error is shown:

A connection attempt failed because the connected party did not properly respond after a period of time (...)

Again, open the Wazuh agent Application and click on View > View logs.

And share the logs with me in a text file.
Also, go to the Wazuh Manager’s server. Use the CIL and run this command to check for any relevant errors in the manager’s log. cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"
Ref: Wazuh agent enrollment troubleshooting


Let me know how it goes.

[Merwin samuel]

Dear sir/mam.

              I have followed your instructions and get the agent running, but in my server it was showing as never connected 

              Can you please help me in connection (or synchronization) of the system to show active in server, I am learning about the SEIM tool in coursera so practicing it so that I can shift to SOC analyst in future so please help me out. 

Thank you. 

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/c93c37be-9e7f-434a-8f71-758c4869d7b6n%40googlegroups.com.

[Md. Nazmur Sakib]

Are you still getting this error?

The agent takes a few seconds to become active once it connects with the Wazuh manager.
Keep in mind that the agent's version should be the same or less than the Wazuh Manager version to work properly.
If the agent still shows not connected

Go to the Wazuh Manager’s CIL and check for any relevant errors in the manager’s log.

cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"

Also, check the agent’s logs

C:\Program Files (x86)\ossec-agent\ossec.log

Share those findings with me so that I can guide you further on this.

[Merwin samuel]

Hi 

       I run log in agent and forund the error can please explains the steps to solve it

        Please check and let me know. 

Thank you

To view this discussion visit https://groups.google.com/d/msgid/wazuh/38579ca2-456b-4ccc-9439-7c07c4261e96n%40googlegroups.com.

[Md. Nazmur Sakib]

Based on the logs you have shared

2026/03/13 00:22:45 wazuh-agent: ERROR: (1216): Unable to connect to '[10.0.2.15]:1514/tcp': 'A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

It seems the agent is having a connection issue with the manager.


Run these commands to check the connection.

Open a PowerShell terminal and run the following command:

(new-object Net.Sockets.TcpClient).Connect("10.0.2.15", 1514)

(new-object Net.Sockets.TcpClient).Connect("10.0.2.15", 1515)

(new-object Net.Sockets.TcpClient).Connect("10.0.2.15", 55000)

If there is connectivity, there is no output. Otherwise, an error is shown:

A connection attempt failed because the connected party did not properly respond after a period of time (...)

If you see a connection error.

Review your OS and/or network firewall and network configuration.

These two ports need to be opened for agent communication.

1514 TCP/UDP: Agent-to-manager communication (events/data).

1515 TCP: Agent enrollment (authentication).
And 55000 TCP is for Wazuh API.
Let me know if you need any further help.