Problem with enrolling an agent on Ubuntu (an agent is not detected on the server side)

172 views
Skip to first unread message

Strzyga 19

unread,
Jan 7, 2023, 4:30:57 PM1/7/23
to Wazuh mailing list
Hello,
I've got a problem. Could do you help me with my problem (ofc if you have a time and the will :-)  )? I cannot enroll wazuh- agent. 


 I've got a problem with agent enrollment on my Linux machine. I've got such a message from my logs. "wazuh-agentd: ERROR: SSL error (5). Connection refused by the manager. Maybe the port specified is incorrect."

My ports on server are open root@ hostname:/var/ossec/bin# nc -zv 192.168.1.162 1514 1515 55000
Connection to 192.168.1.162 1514 port [tcp/*] succeeded!
Connection to 192.168.1.162 1515 port [tcp/*] succeeded!
Connection to 192.168.1.162 55000 port [tcp/*] succeeded!

 on the agent machine I've got a correct config and this IP is the IP of my server
 /var/ossec/etc/ossec.conf<ossec_config>
  <client>
    <server>
      <address>192.168.1.162</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>

Ping works between machines with wazuh-manager and wazuh-agent. Unfortunately the agent is not detected. I restarted all services related to Wazuh either on server or agent machine, but it's not helped.

Octavio Valle López

unread,
Jan 9, 2023, 12:18:27 AM1/9/23
to Wazuh mailing list
Hi, I hope you are well.

Could you tell me what version of wazuh you are using? for both the agent and the manager.

If you register your agent with the api, does the agent work?
https://documentation.wazuh.com/current/user-manual/agent-enrollment/via-manager-API/index.html

Strzyga 19

unread,
Jan 9, 2023, 3:46:38 AM1/9/23
to Wazuh mailing list
I key in on my server wazuh-control -j info and I have:
{"error":0,"data":[{"WAZUH_VERSION":"v4.3.10"},{"WAZUH_REVISION":"40323"},{"WAZUH_TYPE":"server"}]}

I know that maybe not the most intelligent querstion but how I can check version of agent. When I wrote  sudo apt list --installed then I received  "E: Conflicting values set for option Signed-By regarding source https://packages.wazuh.com/4.x/apt/ stable: /usr/share/keyrings/wazuh.gpg !=
E: The list of sources could not be read."
Reply all
Reply to author
Forward
0 new messages