Wazuh 代理连接失败和日志中损坏的负载错误

Question

I have given a Wazuh manager IP and user name and password. I installed the wazuh agent on my laptop but it is connected to the Manager IP. it is not returning the Authorization key and throw the errors in log file.

Important Note:

I am using VPS and install Wazuh agent on it. The errors are

2020/10/29 18:01:55 agent-auth: ERROR: Unable to connect to 10.50.51.64:1515
2020/10/29 18:02:01 ossec-agent: ERROR: Corrupt payload (exceeding size) received.
2020/10/29 18:02:01 ossec-agent: WARNING: Polling server '10.50.51.64' failed. Skipping enrollment.
2020/10/29 18:03:01 ossec-agent: ERROR: Corrupt payload (exceeding size) received.
2020/10/29 18:03:01 ossec-agent: WARNING: Polling server '10.50.51.64' failed. Skipping enrollment

Answer 1

I would like to help you with this problem but I'm not able to reproduce it.

From your logs, I see you're running an 4.0 agent which has (by default) the auto-enrollment capability enabled. The warning:

2020/10/29 18:03:01 ossec-agent: WARNING: Polling server '10.50.51.64' failed. Skipping enrollment

Is generated during an autoenrollment attempt when something went wrong with the manager communication.

This other message:

2020/10/29 18:01:55 agent-auth: ERROR: Unable to connect to 10.50.51.64:1515

Seems to be produced by a manuall registration attempt using agent-auth. You actually don't need to manually register the agent if autoenrollment is enabled, as it would register automatically but this isn't generating the error, it just indicates that authd didn't work as well.

Finally, this message:

2020/10/29 18:02:01 ossec-agent: ERROR: Corrupt payload (exceeding size) received.

Indicates that the agent is receiving an aswer from the manager but it is corrupted, probably by a networking problem.

For your message and your logs, I would say that the agent is actually registered but it cannot receive the generated key (an thus, it won't be able to communicate with the manager).

Is it possible that some configuration in your networks is interfering with the manager response which should send the key to the agent? Have you tried to clean everything an register again? Also, that ip 10.50.51.64 is fully accesible from the agent?

If you tell us about your environment (OS involved, networking, virtualization if exists, etc...) We may be able to give you something more accurate.