Re: Windows Agent - "Unable to connect to <MANAGER IP>:1515

[Tomas Turina]

Hi Seth,

I'm glad to hear that you are using Wazuh.

I would like to know two things that may be wrong with your configuration:

• Have you replaced the tag <MANAGER IP> with the IP of your manager in the ossec.conf file of the Windows agent?
• You need to check that the protocol (TCP or UDP) configured in the manager is the same as the one configured in the agent. Please, check that those values are the same.

Remember to restart the Wazuh service after applying any change in the configuration.

I hope this information helps.

Tomás Turina

On Thu, Mar 3, 2022 at 4:41 PM 'Seth Weber' via Wazuh mailing list <wa...@googlegroups.com> wrote:

Wazuh Windows Agent won't connect to my Wazuh server for some reason... all required ports are open (1514, 1515, 55000, etc), even tested connection from workstation to server and it made it. When I check my firewall, I don't see any logs for connections from the laptop I'm testing the agent on, it honestly seems like the wazuh agent isn't even actually attempting to make a connection on the laptop. It tries for a bit, and keeps repeating that "Unable to connect" error.

Windows Firewall isn't blocking Wazuh, neither is Software Restrictions. The agent runs fine to my knowledge, it just can't connect to my Wazuh Server.

Attached is the ossec.log file from the Windows laptop's Wazuh Agent install.

Thank you!

Confidentiality Statement:  The information accompanying this email transmission is intended for the use of the individual to whom it is addressed & may contain information which is privileged, confidential & exempt from disclosure under applicable law.  If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.  If you have received this email in error please notify us immediately by telephone at 814-297-8400.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/c55656b4-0ada-4883-a1d2-5085b6faa247n%40googlegroups.com.

[Seth Weber]

Yes, I substituted it with <MANAGER IP> for privacy reasons. Same port and TCP set in both Manager and Agent.

[Seth Weber]

Is the Wazuh Agent for Windows supported on Windows 11?

[Tomas Turina]

Hi Seth,

Windows 11 will be supported when Wazuh v4.3.0 is released, which should be very soon.

Best regards,

Tomás Turina

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/307c5b4d-b223-46bd-8875-b3446c92eaddn%40googlegroups.com.