ossec-agentd(4101): WARN: Waiting for server reply (not started).

[renhao-dot]

May I ask how to solve this problem? The client cannot connect to the server, and I have been researching for several days without getting a solution, which is very troublesome

1. Is it a version issue?
2. Is there any problem with configuring the ossec.exe file normally?
3. Is the firewall blocking traffic?
   I have opened UDP1514 and UDP514 ports
   Can you provide me with a complete installation tutorial? Is there anything missing? Thank you

[mystixism]

The "WARN: Waiting for server reply (not started)" means the OSSEC agent is attempting to talk to the manager but isn't receiving a response, suggesting the manager isn't fully working or is unreachable. This could be due to network issues, firewall settings, or configuration mismatches.

Check Connectivity: Ensure the agent can reach the manager's IP and port (default 1514) using ping

Verify Firewall: Confirm UDP port 1514 is open on both the agent (outbound) and manager (inbound). For example, with firewalld, run sudo firewall-cmd --add-port=1514/udp --permanent && sudo firewall-cmd --reload on the manager

Manager Status: On the manager, check if it's listening with sudo netstat -tuln | grep 1514 or sudo ss -tuln | grep 1514. Restart it with sudo /var/ossec/bin/ossec-control restart if needed, and review /var/ossec/logs/ossec.log for errors.

Agent Config: In /var/ossec/etc/ossec.conf, ensure the matches the manager's IP. Restart the agent after changes.

Key Verification: If the agent was recently added, re-import the authentication key from the manager using /var/ossec/bin/manage_agents and apply it on the agent with /var/ossec/bin/manage_agents -i <key>.

After applying fixes, restart the agent and check its status with /var/ossec/bin/agent_control -i.
https://www.ossec.net/docs/