u/h2oliu

Relatively new to Wazuh. Setting up a PoC.

I followed the directions for setting up a Wazuh manager to listen on syslog.

It isn’t able to start the listener on port 514 (tcp or udp). It errors with “Transport endpoint is not connected.”

I confirmed nothing was listening on the port with netstat

If I run netcat, I can set up a listener, and it receives the syslogs.

I tried other ports as well, same error. Searching only found an issue with the client that was fixed by an upgrade, but I downloaded the system within the last week.

Any ideas?

What things that you started doing because of either first impressions, or misunderstanding did you need to unlearn?

Me: First time I threw a potion at the wall of fire, I didn’t choose a specific one, so I assumed any potion worked, without realizing only some worked.