Linux wazuh agents failing to connect to SO

[ll3N1GmAll]

SO version 2.3.240
All windows clients are reporting in successfully
One Linux client is reporting is successfully
All endpoints have their firewalls open for both protocols and in both directions to the SO standalone server
The one Linux client that is reporting in looked like this when registering:

2023/05/06 00:22:34 agent-auth: INFO: Started (pid: 387133).
2023/05/06 00:22:34 agent-auth: INFO: Starting enrollment process to server: SO_IP
2023/05/06 00:22:34 agent-auth: INFO: Connected to SO_IP:1515
2023/05/06 00:22:34 agent-auth: INFO: Registering agent to unverified manager.
2023/05/06 00:22:34 agent-auth: INFO: No authentication password provided.
2023/05/06 00:22:34 agent-auth: INFO: Using agent name as: <CLIENT_HOSTNAME>
2023/05/06 00:22:34 agent-auth: INFO: Request sent to manager
2023/05/06 00:22:34 agent-auth: INFO: Waiting for manager reply
2023/05/06 00:22:34 agent-auth: INFO: Received response with agent key
2023/05/06 00:22:34 agent-auth: INFO: Valid key created. Finished.
2023/05/06 00:22:34 agent-auth: INFO: Connection closed.

The remaining Linux clients that appear to register successfully, but that are not reporting in, even after restarting the wazuh-agent, look like this:

2023/05/06 00:09:43 agent-auth: INFO: Started (pid: 5984).
2023/05/06 00:09:43 agent-auth: INFO: Requesting a key from server: SO_IP
2023/05/06 00:09:43 agent-auth: INFO: No authentication password provided
2023/05/06 00:09:43 agent-auth: INFO: Using agent name as: <CLIENT_HOSTNAME>
2023/05/06 00:09:43 agent-auth: INFO: Waiting for server reply
2023/05/06 00:09:43 agent-auth: INFO: Valid key received

The Linux clients look like they are registering and I can see them listed on SO when SSH'd in in the list of registered agents. I am not sure why they are not working, even though they look like they have registered properly.

These agents were connected to a prior SO standalone server that was replaced with a newly built SO standalone server, with the same MAC and IP, from scratch. I'm not sure if that could have an impact on why it is showing like these client agents are registering yet not actually working.

[InfosecGoon]

You mentioned that these agents are left over from a former installation -- are they the proper version? That is, do they match the version of the Wazuh client in the Downloads area of SOC?

[ll3N1GmAll]

Thanks for your reply. How can I check? I tried
wazuh-agent -v
from the client and I tried
/var/ossec/bin/agent-control -i <agent_id>
from the manager; but neither worked.

[ll3N1GmAll]

I installed the wazuh-agent from the distros software repo. So, I did not install the DEB/RPM from the Downloads page. However, I have 2 machines on the same distro and one works, while the other doesnt. I can try to install the DEB/RPM from the downloads page to see if that resolves the issue and report back. I do want to know how to check the installed version though.

[ll3N1GmAll]

On my Debian based distros, the repo had wazuh agent version 4.4.1-1. Installing 3.13.1-1 seems to have resolved the issue with regards to the terminal output. They all now show output like this:

2023/05/06 00:22:34 agent-auth: INFO: Started (pid: 387133).
2023/05/06 00:22:34 agent-auth: INFO: Starting enrollment process to server: SO_IP
2023/05/06 00:22:34 agent-auth: INFO: Connected to SO_IP:1515
2023/05/06 00:22:34 agent-auth: INFO: Registering agent to unverified manager.
2023/05/06 00:22:34 agent-auth: INFO: No authentication password provided.
2023/05/06 00:22:34 agent-auth: INFO: Using agent name as: <CLIENT_HOSTNAME>
2023/05/06 00:22:34 agent-auth: INFO: Request sent to manager
2023/05/06 00:22:34 agent-auth: INFO: Waiting for manager reply
2023/05/06 00:22:34 agent-auth: INFO: Received response with agent key
2023/05/06 00:22:34 agent-auth: INFO: Valid key created. Finished.
2023/05/06 00:22:34 agent-auth: INFO: Connection closed.

And they are all showing listed in the Wazuh agent manager.
However, none of them (other than the one that was working before) are showing in the SO alerts/hunt/etc. dashboards.