scenario: an amd64 ossec-hids server running ossec-hids-server-3.6.0_1 under FreeBSD 12.2-RELEASE-p3 GENERIC amd64 serves various agents from amd64 machines without problems. a PPC64 freebsd machine running ossec-hids-agent-3.6.0_1 under FreeBSD 12.2-RELEASE-p3 r369227 GENERIC powerpc is not recognised by the server. On the server I get a lot of 2021/06/08 16:30:22 ossec-remoted(1403): ERROR: Incorrectly formatted message from '212.45.144.123'. if I start ossec-remoted with debug option enabled.
(In reply to Luciano Mannucci from comment #0) Have you tried resetting counters? On the agent run: /usr/local/etc/rc.d/ossec-hids fetch_config and follow the instructions if it fails.
Sounds like the software has poor marshalling and doesn't convert endianess. Please report this bug with upstream who is much more likely to be able to do something about this. I've CC'ed pkubaj@ who is our resident ppc guy.