File shared/agent.conf not found

[Craig]

Environment: Version 2.9RC2 client/server

When starting my agent service, I get the following:

2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. (line 8).

On my server, the file is certainly there and the the verify-agent-config script checks out okay

Any idea on what might be causing this?

Thank you!

[dan (ddp)]

Is the file on the agent?
What are the permissions of the /var/ossec/etc/shared directory?
Do the contents of the agent.conf show up in the server's
/var/ossec/etc/shared/merged.mg file? In the agent's?


> Thank you!
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Craig]

Thanks Dan. The permissions on my server folder:

drwxrwx---  2 root ossec   4096 Jul 26 12:37 shared

Yes, the contents of agent.conf are in merged.mg on the server

No, I do not even see a merged.mg on the windows agent

Thanks for any ideas that may help resolve!!

[dan (ddp)]

On Tue, Jul 26, 2016 at 2:11 PM, Craig <chmit...@gmail.com> wrote:
> Thanks Dan. The permissions on my server folder:
>
> drwxrwx--- 2 root ossec 4096 Jul 26 12:37 shared
>
> Yes, the contents of agent.conf are in merged.mg on the server
>
> No, I do not even see a merged.mg on the windows agent
>

I missed that it was a Windows agent in the original message. I don't
have one do check, so I don't know how it really works in this
situation.
I guess try restarting the Windows agent services. I don't know what
the permissions should be for the shared directory in Windows.
Also make sure ossec-monitord is running on the server. I think that
handles this stuff.

[Craig]

Thanks Dan,

Yes, my server is running Ubuntu 16.04 with OSSEC 2.9RC2

I have a Windows 7 2.9RC2 agent installed, registered, and communicating with the OSSEC Ubuntu server

For some reason, though, I can't get it to pull the agent.conf file from the server

I have tried restarting the agent service on the Windows 7 agent multiple times, but still get the same:

2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. (line 8).

The ossec-monitord service on the Ubuntu server is running

If I get it figured out, i'll post back, but for now I'm not sure what the problem could be.

Thanks.

[dan (ddp)]

On Tue, Jul 26, 2016 at 2:41 PM, Craig <chmit...@gmail.com> wrote:
> Thanks Dan,
> Yes, my server is running Ubuntu 16.04 with OSSEC 2.9RC2
> I have a Windows 7 2.9RC2 agent installed, registered, and communicating
> with the OSSEC Ubuntu server
> For some reason, though, I can't get it to pull the agent.conf file from the
> server
> I have tried restarting the agent service on the Windows 7 agent multiple
> times, but still get the same:
> 2016/07/26 12:27:54 ossec-agent(1226): ERROR: Error reading XML file
> 'shared/agent.conf': XMLERR: File 'shared/agent.conf' not found. (line 8).
> The ossec-monitord service on the Ubuntu server is running
> If I get it figured out, i'll post back, but for now I'm not sure what the
> problem could be.
> Thanks.
>

You could try creating merged.mg on the agent. Because it's Windows I
don't know the expected permissions off hand.